Re: Logging SNAT'ed connections

	Hi, Kerin,

Kerin Millar wrote:
> Unfortunately, it appears to be a bug affecting ICMP. Possibly here:
> 
> https://git.netfilter.org/libnetfilter_conntrack/tree/src/conntrack/objopt.c?id=7e5397b9167bdd7597be809b8f088ff333e1ad31#n189
> 
> For now, I would suggest filtering with something else.
> 
> conntrack -E -o id,timestamp |
> perl -ne 'print if /\bsrc=(\S+).*\bdst=(\S+)/ && $1 ne $2'

Oh, I did not expect it to be a bug.

Anyway, you probably mean src= in both cases. Using backreferences,
I did it this way:

perl -nE 'print if /\bsrc=(\S+)\s.*\bsrc=(?!\1\s)/'

Thanks!

-Yenya

-- 
| Jan "Yenya" Kasprzak <kas at {fi.muni.cz - work | yenya.net - private}> |
| https://www.fi.muni.cz/~kas/                        GPG: 4096R/A45477D5 |
    I don't like Python; its lack of inline, anonymous, multi-statement
    functions makes me sad.                                --Eric Wastl