Patent ID: 8701179

Claim:
A network device comprising: a plurality of interfaces configured to send and receive packets for communication sessions associated with subscribers of a service provider network; a database storing network address translation (NAT) bindings that map private network addresses of the subscribers to public network addresses, wherein the database stores session data for the communication sessions associated with the NAT bindings; a NAT controller that provides network address translation for the packets to translate between the private network addresses the public network addresses; an interface that provides a refresh control input to control refresh of the communication sessions associated with the NAT bindings; wherein the NAT controller maintains a session timer for each of the communication sessions and removes session data for a communication session from the database when the session timer indicates that packets have not been detected on the communication session for a threshold amount of time, wherein, responsive to receiving outbound packets from the subscribers, the NAT controller processes each of the outbound packets to determine whether the outbound packet comprises an outbound data packet or an outbound error message, and wherein, in accordance with a security setting of the refresh control input, the NAT controller restarts the session timer in response to determining the outbound packet comprises an outbound data packet from the subscribers and does not restart the session timer in response to determining the outbound packet comprises an outbound error message sent by the subscribers in reply to inbound packets.