Logging SNAT'ed connections

[Jan Kasprzak <kas@fi.muni.cz>]

Hi all,

how do you log SNAT'ed connections for further forensic purposes,
when somebody complains about your public IP address and you want to be
able to find a local user behind NAT?

I used to run something like

conntrack --event --buffer-size 1600000 -o id,timestamp --src-nat >> $LOGFILE

which did what I want. But now I tried to run the same on AlmaLinux9 host,
and it seems that --src-nat filter does not get applied - it shows
even connections which are not SNAT'ed at all, because they are for my
own IP address:

[1780936563.343940]	    [NEW] icmp     1 30 src=128.1.227.61 dst=xx.yy.zz.13 type=8 code=0 id=8724 [UNREPLIED] src=xx.yy.zz.13 dst=128.1.227.61 type=0 code=0 id=8724 id=2525400839
[1780936563.343994]	 [UPDATE] icmp     1 30 src=128.1.227.61 dst=xx.yy.zz.13 type=8 code=0 id=8724 src=xx.yy.zz.13 dst=128.1.227.61 type=0 code=0 id=8724 id=2525400839
[1780936565.281121]	    [NEW] icmp     1 30 src=128.1.227.61 dst=xx.yy.zz.11 type=8 code=0 id=8724 [UNREPLIED] src=xx.yy.zz.11 dst=128.1.227.61 type=0 code=0 id=8724 id=2574615308
[1780936565.281167]	 [UPDATE] icmp     1 30 src=128.1.227.61 dst=xx.yy.zz.11 type=8 code=0 id=8724 src=xx.yy.zz.11 dst=128.1.227.61 type=0 code=0 id=8724 id=2574615308

Here xx.yy.zz.11 and .13 are my public IP addresses. Why do these connections
show up in the conntrack --event --src-nat output? Thanks!

-Yenya

-- 
| Jan "Yenya" Kasprzak <kas at {fi.muni.cz - work | yenya.net - private}> |
| https://www.fi.muni.cz/~kas/                        GPG: 4096R/A45477D5 |
    I don't like Python; its lack of inline, anonymous, multi-statement
    functions makes me sad.                                --Eric Wastl