Re: Logging nat translations

[Pablo Neira Ayuso <pablo@netfilter.org>]

Eric Leblond wrote:
> Hello,
> 
> On Thursday, 2008 August 28 at 10:10:20 -0400, Carlos Sülz wrote:
>> Hi NF people, I've a question related a Logging issue.-
>>
>> I'm already making a log with my conntrack session, but I need to log  
>> the "nated-IP" because auditoring.-
>>
>> I mean...
>> the "-j LOG" parameter log the SRC-IP and the DST-IP (src is the IP  
>> before nat and the dst is... well, U know it.)
>> I need something like SRC= 10.x.x.x, NAT=200.x.x.x , DST=201.x.x.x
>> If there is a way to get this, please let me know.
> 
> Have a look at ulogd2 which is able to log every connection tracking
> event in a file or in a database.
> 
> Some links:
> 	http://netfilter.org/projects/ulogd/index.html
> 	http://software.inl.fr/trac/wiki/ulogd2/user

You can also get them via the command line tool `conntrack':

# conntrack -E --src-nat

or

# conntrack -E --dst-nat

or even:

# conntrack -E --dst-nat 1.2.3.4

to filter only destination NAT to 1.2.3.4.

-- 
"Los honestos son inadaptados sociales" -- Les Luthiers