Re: Logging SNAT'ed connections

On Wed, 10 Jun 2026, at 12:18 PM, Pablo Neira Ayuso wrote:
> On Mon, Jun 08, 2026 at 06:53:30PM +0100, Kerin Millar wrote:
>> On Mon, 8 Jun 2026, at 5:38 PM, Jan Kasprzak wrote:
>> > Hi all,
>> >
>> > how do you log SNAT'ed connections for further forensic purposes,
>> > when somebody complains about your public IP address and you want to be
>> > able to find a local user behind NAT?
>> >
>> > I used to run something like
>> >
>> > conntrack --event --buffer-size 1600000 -o id,timestamp --src-nat >> $LOGFILE
>> >
>> > which did what I want. But now I tried to run the same on AlmaLinux9 host,
>> > and it seems that --src-nat filter does not get applied - it shows
>> > even connections which are not SNAT'ed at all, because they are for my
>> > own IP address:
>> >
>> > [1780936563.343940]	    [NEW] icmp     1 30 src=128.1.227.61 
>> > dst=xx.yy.zz.13 type=8 code=0 id=8724 [UNREPLIED] src=xx.yy.zz.13 
>> > dst=128.1.227.61 type=0 code=0 id=8724 id=2525400839
>> > [1780936563.343994]	 [UPDATE] icmp     1 30 src=128.1.227.61 
>> > dst=xx.yy.zz.13 type=8 code=0 id=8724 src=xx.yy.zz.13 dst=128.1.227.61 
>> > type=0 code=0 id=8724 id=2525400839
>> > [1780936565.281121]	    [NEW] icmp     1 30 src=128.1.227.61 
>> > dst=xx.yy.zz.11 type=8 code=0 id=8724 [UNREPLIED] src=xx.yy.zz.11 
>> > dst=128.1.227.61 type=0 code=0 id=8724 id=2574615308
>> > [1780936565.281167]	 [UPDATE] icmp     1 30 src=128.1.227.61 
>> > dst=xx.yy.zz.11 type=8 code=0 id=8724 src=xx.yy.zz.11 dst=128.1.227.61 
>> > type=0 code=0 id=8724 id=2574615308
>> >
>> > Here xx.yy.zz.11 and .13 are my public IP addresses. Why do these connections
>> > show up in the conntrack --event --src-nat output? Thanks!
>> 
>> Unfortunately, it appears to be a bug affecting ICMP. Possibly here:
>> 
>> https://git.netfilter.org/libnetfilter_conntrack/tree/src/conntrack/objopt.c?id=7e5397b9167bdd7597be809b8f088ff333e1ad31#n189
>
> Maybe then this helps?
>
> https://patchwork.ozlabs.org/project/netfilter-devel/patch/[email protected]/

I have not yet tried it but shouldn't the helper function be checking against the protonum field? Also, the referenced commit appears unrelated to the fix. I think it should refer to b4c3a23c884c.

--
Kerin Millar