Re: Logging SNAT'ed connections

On Mon, 8 Jun 2026, at 9:11 PM, Jan Kasprzak wrote:
> Hi, Kerin,
>
> Kerin Millar wrote:
>> Unfortunately, it appears to be a bug affecting ICMP. Possibly here:
>> 
>> https://git.netfilter.org/libnetfilter_conntrack/tree/src/conntrack/objopt.c?id=7e5397b9167bdd7597be809b8f088ff333e1ad31#n189
>> 
>> For now, I would suggest filtering with something else.
>> 
>> conntrack -E -o id,timestamp |
>> perl -ne 'print if /\bsrc=(\S+).*\bdst=(\S+)/ && $1 ne $2'
>
> Oh, I did not expect it to be a bug.
>
> Anyway, you probably mean src= in both cases. Using backreferences,
> I did it this way:
>
> perl -nE 'print if /\bsrc=(\S+)\s.*\bsrc=(?!\1\s)/'

The idea I had in mind was to compare orig.src against reply.dst. Where orig.src != reply.dst, NAT applies. Your approach compares orig.src to reply.src. Those will differ for most flows, whether they were subjected to NAT or not.

I would tend not to use backreferences in that way because it becomes quite easy to make a mistake.

$ printf 'x=123.45 y=123.45\n' | perl -nE 'say "matched: $1" if /x=(\S+).*\by=(?!\1\s)/'
matched: 123.4

--
Kerin Millar