Re: Logging SNAT'ed connections

On 6/8/26 1:47 PM, Kerin Millar wrote:
> On Mon, 8 Jun 2026, at 9:11 PM, Jan Kasprzak wrote:
>> Hi, Kerin,
>>
>> Kerin Millar wrote:
>>> Unfortunately, it appears to be a bug affecting ICMP. Possibly here:
>>>
>>> https://git.netfilter.org/libnetfilter_conntrack/tree/src/conntrack/objopt.c?id=7e5397b9167bdd7597be809b8f088ff333e1ad31#n189
>>>
>>> For now, I would suggest filtering with something else.
>>>
>>> conntrack -E -o id,timestamp |
>>> perl -ne 'print if /\bsrc=(\S+).*\bdst=(\S+)/ && $1 ne $2'
>> Oh, I did not expect it to be a bug.
>>
>> Anyway, you probably mean src= in both cases. Using backreferences,
>> I did it this way:
>>
>> perl -nE 'print if /\bsrc=(\S+)\s.*\bsrc=(?!\1\s)/'
> The idea I had in mind was to compare orig.src against reply.dst. Where orig.src != reply.dst, NAT applies. Your approach compares orig.src to reply.src. Those will differ for most flows, whether they were subjected to NAT or not.
>
> I would tend not to use backreferences in that way because it becomes quite easy to make a mistake.
>
> $ printf 'x=123.45 y=123.45\n' | perl -nE 'say "matched: $1" if /x=(\S+).*\by=(?!\1\s)/'
> matched: 123.4

Exactly, great care needs to be taken with back references; also given 
'x=123.4 y=123.45', the \1 will match the '123.4' portion of 'y=123.45', 
making it seems like they're equal when they're not, so getting it done 
properly going that route will be far more complex.

Instead, here ...

$ for s in 'x=123.45 y=123.45'  'x=123.4 y=123.45'  'x=123.45 y=123.4' ; do
   printf "%s\n" "$s" | perl -nE 'say "x $1 does not match y $2" if m{
       \b x=(\S+)  .*  \b y=(\S+)
     }x && $1 ne $2;'
done
x 123.4 does not match y 123.45
x 123.45 does not match y 123.4

...is a cleaner way if one wants a more readable version.

-- 
gfish