Re: Logging SNAT'ed connections

On Wed, 10 Jun 2026, at 4:31 PM, Pablo Neira Ayuso wrote:
> On Wed, Jun 10, 2026 at 01:04:54PM +0100, Kerin Millar wrote:
>> On Wed, 10 Jun 2026, at 12:18 PM, Pablo Neira Ayuso wrote:
>> > On Mon, Jun 08, 2026 at 06:53:30PM +0100, Kerin Millar wrote:
>> >> On Mon, 8 Jun 2026, at 5:38 PM, Jan Kasprzak wrote:
>> >> > Hi all,
>> >> >
>> >> > how do you log SNAT'ed connections for further forensic purposes,
>> >> > when somebody complains about your public IP address and you want to be
>> >> > able to find a local user behind NAT?
>> >> >
>> >> > I used to run something like
>> >> >
>> >> > conntrack --event --buffer-size 1600000 -o id,timestamp --src-nat >> $LOGFILE
>> >> >
>> >> > which did what I want. But now I tried to run the same on AlmaLinux9 host,
>> >> > and it seems that --src-nat filter does not get applied - it shows
>> >> > even connections which are not SNAT'ed at all, because they are for my
>> >> > own IP address:
>> >> >
>> >> > [1780936563.343940]	    [NEW] icmp     1 30 src=128.1.227.61 
>> >> > dst=xx.yy.zz.13 type=8 code=0 id=8724 [UNREPLIED] src=xx.yy.zz.13 
>> >> > dst=128.1.227.61 type=0 code=0 id=8724 id=2525400839
>> >> > [1780936563.343994]	 [UPDATE] icmp     1 30 src=128.1.227.61 
>> >> > dst=xx.yy.zz.13 type=8 code=0 id=8724 src=xx.yy.zz.13 dst=128.1.227.61 
>> >> > type=0 code=0 id=8724 id=2525400839
>> >> > [1780936565.281121]	    [NEW] icmp     1 30 src=128.1.227.61 
>> >> > dst=xx.yy.zz.11 type=8 code=0 id=8724 [UNREPLIED] src=xx.yy.zz.11 
>> >> > dst=128.1.227.61 type=0 code=0 id=8724 id=2574615308
>> >> > [1780936565.281167]	 [UPDATE] icmp     1 30 src=128.1.227.61 
>> >> > dst=xx.yy.zz.11 type=8 code=0 id=8724 src=xx.yy.zz.11 dst=128.1.227.61 
>> >> > type=0 code=0 id=8724 id=2574615308
>> >> >
>> >> > Here xx.yy.zz.11 and .13 are my public IP addresses. Why do these connections
>> >> > show up in the conntrack --event --src-nat output? Thanks!
>> >> 
>> >> Unfortunately, it appears to be a bug affecting ICMP. Possibly here:
>> >> 
>> >> https://git.netfilter.org/libnetfilter_conntrack/tree/src/conntrack/objopt.c?id=7e5397b9167bdd7597be809b8f088ff333e1ad31#n189
>> >
>> > Maybe then this helps?
>> >
>> > https://patchwork.ozlabs.org/project/netfilter-devel/patch/[email protected]/
>> 
>> I have not yet tried it but shouldn't the helper function be checking against the protonum field? Also, the referenced commit appears unrelated to the fix. I think it should refer to b4c3a23c884c.
>
> Thanks for reviewing, v2 is here:
>
> https://patchwork.ozlabs.org/project/netfilter-devel/patch/[email protected]/

Thanks. I'll try v2 out here.

--
Kerin Millar