Re: [PATCH] Add support to log original and NAT-ed IP addresses

[Patrick McHardy <kaber@trash.net>]

Jozsef Kadlecsik wrote:
> On Mon, 20 Apr 2009, Patrick McHardy wrote:
> 
>> Jozsef Kadlecsik wrote:
>>> On Mon, 20 Apr 2009, Pablo Neira Ayuso wrote:
>>>> I wasn't refering to any iptables target. New ulogd2 includes support
>>>> for ctnetlink, which can do this. I know, that means the extra libraries
>>>> dependencies.
>>> I see. Thanks the info, good to know that ulogd2 is capable of this.
>>> (Calling 'conntrack' for logging looked really ugly. :-)
>> In the kernel, we could log the information from the conntrack
>> entry, if any. That would allow to log the manips after they
>> have been set up.
> 
> Yes, but I'd not want an unconditional logging.

I missed the point, you're already doing what I had in mind (use
ct->tuplehash->...) and the new hook is needed to even get a chance
to log the packet after SNAT.

>> Would Pablo's suggestion or the conntrack method work for you?
> 
> Oh, it's not for me at all: at a workshop I was asked how to log the info 
> (hint: conflicker ;-) and embarrased enough I had to admit there was no 
> easy way. That's why I put together the patch, with all it's questionable 
> details.

I can see that it has some informational value, but for things like
locating infected hosts, why not simply look at the traffic before
it is NATed? I currently can't come up with a real use case for
this ...