Natted packets

Natted packets

[Lucas Diaz]

Is it possible to know if a packet passing through my router is (s)natted?
And the original (s)natted IP?
Thank a lot.
Lucas.
TSAS, BSAS, Argentina.

Re: Natted packets

[Jan Engelhardt]

> Is it possible to know if a packet passing through my router is (s)natted?

I think `-m conntrack --ctstate SNAT` should do that.

> And the original (s)natted IP?

For userspace there's a getsockopt() call that you can use to find out.


	-`J'
-- 

Re: Natted packets

[Pablo Neira Ayuso]

Jan Engelhardt wrote:
>> Is it possible to know if a packet passing through my router is (s)natted?
> 
> I think `-m conntrack --ctstate SNAT` should do that.
> 
>> And the original (s)natted IP?
> 
> For userspace there's a getsockopt() call that you can use to find out.

That getsockopt() interface is deprecated. If you're in userspace,
better use the libnetfilter_conntrack library. It has a function to
check if a conntrack has been snatted.

-- 
The dawn of the fourth age of Linux firewalling is coming; a time of
great struggle and heroic deeds -- J.Kadlecsik got inspired by J.Morris

Re: Natted packets

[Grant Taylor]

On 01/08/07 15:43, Lucas Diaz wrote:
> Is it possible to know if a packet passing through my router is (s)natted?
> And the original (s)natted IP?
> Thank a lot.

Are you wanting to know if you are doing the NATing, or if some other 
router somewhere else on the net has NATed the traffic?

If you want to know if you have NATed the packet, I believe the answer 
is yes 
(https://lists.netfilter.org/pipermail/netfilter/2007-January/067687.html).

If you want to know if someone else has NATed the packet, possibly, 
however it is MUCH harder to do if you are not the outbound ISP.

Which question are you asking?



Grant. . . .

Re: Natted packets

[Lucas Diaz]

My question is if some other router somewhere else on the net (inside my 
lan) has NATed the traffic?
And the original NATed IP?
This router NATing traffic and my router are in the same network...

Grant Taylor wrote:
> On 01/08/07 15:43, Lucas Diaz wrote:
>> Is it possible to know if a packet passing through my router is 
>> (s)natted?
>> And the original (s)natted IP?
>> Thank a lot.
>
> Are you wanting to know if you are doing the NATing, or if some other 
> router somewhere else on the net has NATed the traffic?
>
> If you want to know if you have NATed the packet, I believe the answer 
> is yes 
> (https://lists.netfilter.org/pipermail/netfilter/2007-January/067687.html). 
>
>
> If you want to know if someone else has NATed the packet, possibly, 
> however it is MUCH harder to do if you are not the outbound ISP.
>
> Which question are you asking?
>
>
>
> Grant. . . .
>
>
>

Re: Natted packets

[Grant Taylor]

On 01/09/07 05:58, Lucas Diaz wrote:
> My question is if some other router somewhere else on the net (inside my 
> lan) has NATed the traffic?
> And the original NATed IP?
> This router NATing traffic and my router are in the same network...

Ok, you are wanting to see if there is an additional NATing router 
somewhere in your LAN?

(I'll presume yes for the rest of this post)

There are some ways that you can attempt to find IP addresses with 
specific types of behavior (all beyond me) that can be indicative of 
NATed IPs.  I believe that (some of) these tests are based on the TCP 
sequence number.  More specifically, an IP stack *usually* behaves in a 
predictable way.  Thus you can look at the TCP sequence numbers of 
packets coming from an IP address to see patterns of ranges / sliding 
windows of TCP sequence numbers.  If there are multiple (fuzzy) 
definable groups, there is a good chance that each group is a given 
computer.  However, this can possibly be hidden by the NATing device.

Much beyond that and I don't know any more.  However, I do know that 
there is a lot of discussion about this on the reverse side on the net. 
  Namely I have stumbled across a lot of discussion where people were 
trying to use NATing technology on providers that did not want them to, 
i.e. they charged per device, and what they did to hide them selves from 
the provider.



Grant. . . .

Re: Natted packets

[Grant Taylor]

On 01/08/07 15:43, Lucas Diaz wrote:
> Is it possible to know if a packet passing through my router is (s)natted?
> And the original (s)natted IP?

I'm not sure if this applies or not, but something that I just read made 
me think about your question.

If you are wanting to prevent someone on your network from NATing 
multiple IPs behind a router, say you are a provider for a building, you 
might be able to stop them with this.

Set the TTL of packets passing back through your router to your clients 
to 1.  This will probably cause any internal router to drop packets 
seeing a TTL exceeded.

I will not say any thing to the effect that this will have on things 
like TraceRoute, other than it will probably have an effect.

Also, this would be fairly easy to get around on a capable router, say 
Linux, in such as it would be easy to detect an inbound packet with a 
TTL of 1 and set it higher.



Grant. . . .