Re: Logging SNAT'ed connections

On Mon, 8 Jun 2026, at 5:38 PM, Jan Kasprzak wrote:
> Hi all,
>
> how do you log SNAT'ed connections for further forensic purposes,
> when somebody complains about your public IP address and you want to be
> able to find a local user behind NAT?
>
> I used to run something like
>
> conntrack --event --buffer-size 1600000 -o id,timestamp --src-nat >> $LOGFILE
>
> which did what I want. But now I tried to run the same on AlmaLinux9 host,
> and it seems that --src-nat filter does not get applied - it shows
> even connections which are not SNAT'ed at all, because they are for my
> own IP address:
>
> [1780936563.343940]	    [NEW] icmp     1 30 src=128.1.227.61 
> dst=xx.yy.zz.13 type=8 code=0 id=8724 [UNREPLIED] src=xx.yy.zz.13 
> dst=128.1.227.61 type=0 code=0 id=8724 id=2525400839
> [1780936563.343994]	 [UPDATE] icmp     1 30 src=128.1.227.61 
> dst=xx.yy.zz.13 type=8 code=0 id=8724 src=xx.yy.zz.13 dst=128.1.227.61 
> type=0 code=0 id=8724 id=2525400839
> [1780936565.281121]	    [NEW] icmp     1 30 src=128.1.227.61 
> dst=xx.yy.zz.11 type=8 code=0 id=8724 [UNREPLIED] src=xx.yy.zz.11 
> dst=128.1.227.61 type=0 code=0 id=8724 id=2574615308
> [1780936565.281167]	 [UPDATE] icmp     1 30 src=128.1.227.61 
> dst=xx.yy.zz.11 type=8 code=0 id=8724 src=xx.yy.zz.11 dst=128.1.227.61 
> type=0 code=0 id=8724 id=2574615308
>
> Here xx.yy.zz.11 and .13 are my public IP addresses. Why do these connections
> show up in the conntrack --event --src-nat output? Thanks!

Unfortunately, it appears to be a bug affecting ICMP. Possibly here:

https://git.netfilter.org/libnetfilter_conntrack/tree/src/conntrack/objopt.c?id=7e5397b9167bdd7597be809b8f088ff333e1ad31#n189

For now, I would suggest filtering with something else.

conntrack -E -o id,timestamp |
perl -ne 'print if /\bsrc=(\S+).*\bdst=(\S+)/ && $1 ne $2'

-- 
Kerin Millar