Logging SNAT'ed connections

Hi all,

how do you log SNAT'ed connections for further forensic purposes,
when somebody complains about your public IP address and you want to be
able to find a local user behind NAT?

I used to run something like

conntrack --event --buffer-size 1600000 -o id,timestamp --src-nat >> $LOGFILE

which did what I want. But now I tried to run the same on AlmaLinux9 host,
and it seems that --src-nat filter does not get applied - it shows
even connections which are not SNAT'ed at all, because they are for my
own IP address:

[1780936563.343940]	    [NEW] icmp     1 30 src=128.1.227.61 dst=xx.yy.zz.13 type=8 code=0 id=8724 [UNREPLIED] src=xx.yy.zz.13 dst=128.1.227.61 type=0 code=0 id=8724 id=2525400839
[1780936563.343994]	 [UPDATE] icmp     1 30 src=128.1.227.61 dst=xx.yy.zz.13 type=8 code=0 id=8724 src=xx.yy.zz.13 dst=128.1.227.61 type=0 code=0 id=8724 id=2525400839
[1780936565.281121]	    [NEW] icmp     1 30 src=128.1.227.61 dst=xx.yy.zz.11 type=8 code=0 id=8724 [UNREPLIED] src=xx.yy.zz.11 dst=128.1.227.61 type=0 code=0 id=8724 id=2574615308
[1780936565.281167]	 [UPDATE] icmp     1 30 src=128.1.227.61 dst=xx.yy.zz.11 type=8 code=0 id=8724 src=xx.yy.zz.11 dst=128.1.227.61 type=0 code=0 id=8724 id=2574615308

Here xx.yy.zz.11 and .13 are my public IP addresses. Why do these connections
show up in the conntrack --event --src-nat output? Thanks!

-Yenya

-- 
| Jan "Yenya" Kasprzak <kas at {fi.muni.cz - work | yenya.net - private}> |
| https://www.fi.muni.cz/~kas/                        GPG: 4096R/A45477D5 |
    I don't like Python; its lack of inline, anonymous, multi-statement
    functions makes me sad.                                --Eric Wastl