Hi navneet,
In my opinion, in cases of NAT using Port address translation, a total of 64500 ports are available for overloading several clients onto a single public IP. In some cases, such as when the clients are infected with viruses, the design of the virus might be such that it would attempt to open a large number of ports to a certain public IP address on the outside interface. These may remain in the connecting state for a long period of time so they cannot be reassigned to other clients. Compound this with several clients being infected simultaneously and you can see what the scale of the problem could be
In such an event, the NAT device would run of ports to assign to valid connections for applications / email. Clearing the nat translation table would solve the problem temporarily.
Again this is just a hypothetical scenario. Im a noob so dont take my word for it and use a packet sniffer to capture live data using SPAN and analyze it. Also have a look @ your NAT translation table before clearing it to see if you can get some clues as to what might be causing it.
Hope this helps. Do post back if it does! :)
Arvind
