Passenger Wi-Fi at the airport suddenly cannot open new sessions while existing long-lived flows still pass. Engineers suspect the PAT pool is exhausted. Which symptom best matches that NAT condition?

Passenger Wi-Fi that cannot open new sessions while existing long-lived flows still pass is a classic PAT pool exhaustion pattern. New translations fail or drop when the finite public IP/port pool cannot allocate another mapping. Established flows keep their existing port bindings and may continue, while new passenger sessions cannot obtain a fresh inside-to-outside Layer-4 mapping until translations are freed or the pool expands. That “old works, new fails” behavior is the expected effect of overload exhaustion under surge load. OSPF neighbor dead timers expiring because PAT rewrites multicast hellos on the WAN is not the typical exhaustion symptom: an IGP hello failure is a routing-adjacency issue, and routing traffic is generally kept off passenger overload pools. HSRP’s virtual MAC shifting between active and standby routers on each client join is unrelated to PAT port allocation; it describes an FHRP or gateway ARP disruption, not depleted translation capacity. ERSPAN sessions stopping because PAT cannot encapsulate mirrored frames in GRE also does not describe this condition: mirrored-frame encapsulation is separate from allocating PAT mappings for passenger sessions. Exam caveat: associate a full PAT pool with new session failures while existing mappings may persist, rather than mistaking the symptom for routing or FHRP behavior. For a practical check, compare NAT translation counts with pool capacity using show ip nat statistics and translation-table output, look for allocation failures, and confirm whether freeing stale translations or adding public IP capacity restores new session setup.