Re: Logging SNAT'ed connections

Kerin Millar wrote:
> On Mon, 8 Jun 2026, at 9:11 PM, Jan Kasprzak wrote:
> > Hi, Kerin,
> >
> > Kerin Millar wrote:
> >> Unfortunately, it appears to be a bug affecting ICMP. Possibly here:
> >> 
> >> https://git.netfilter.org/libnetfilter_conntrack/tree/src/conntrack/objopt.c?id=7e5397b9167bdd7597be809b8f088ff333e1ad31#n189
> >> 
> >> For now, I would suggest filtering with something else.
> >> 
> >> conntrack -E -o id,timestamp |
> >> perl -ne 'print if /\bsrc=(\S+).*\bdst=(\S+)/ && $1 ne $2'
> >
> > Oh, I did not expect it to be a bug.
> >
> > Anyway, you probably mean src= in both cases. Using backreferences,
> > I did it this way:
> >
> > perl -nE 'print if /\bsrc=(\S+)\s.*\bsrc=(?!\1\s)/'
> 
> The idea I had in mind was to compare orig.src against reply.dst. Where orig.src != reply.dst, NAT applies. Your approach compares orig.src to reply.src. Those will differ for most flows, whether they were subjected to NAT or not.

OK, understood. Thanks for clarification.

> I would tend not to use backreferences in that way because it becomes quite easy to make a mistake.
> 
> $ printf 'x=123.45 y=123.45\n' | perl -nE 'say "matched: $1" if /x=(\S+).*\by=(?!\1\s)/'
> matched: 123.4

This is why I had \s after the first group: (\S+)\s.* instead of (\S+).*
But yes, if we are trying to match the first src= against the second dst=,
we would hav to avoid .* to match the first dst= instead. Something like
this:

perl -nE 'print if /\bsrc=(\S+)\s.*\bdst=.*\bdst=(?!\1\s)/'

-Yenya

-- 
| Jan "Yenya" Kasprzak <kas at {fi.muni.cz - work | yenya.net - private}> |
| https://www.fi.muni.cz/~kas/                        GPG: 4096R/A45477D5 |
    I don't like Python; its lack of inline, anonymous, multi-statement
    functions makes me sad.                                --Eric Wastl