Re: Logging SNAT'ed connections

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Mon, Jun 08, 2026 at 06:53:30PM +0100, Kerin Millar wrote:
> On Mon, 8 Jun 2026, at 5:38 PM, Jan Kasprzak wrote:
> > Hi all,
> >
> > how do you log SNAT'ed connections for further forensic purposes,
> > when somebody complains about your public IP address and you want to be
> > able to find a local user behind NAT?
> >
> > I used to run something like
> >
> > conntrack --event --buffer-size 1600000 -o id,timestamp --src-nat >> $LOGFILE
> >
> > which did what I want. But now I tried to run the same on AlmaLinux9 host,
> > and it seems that --src-nat filter does not get applied - it shows
> > even connections which are not SNAT'ed at all, because they are for my
> > own IP address:
> >
> > [1780936563.343940]	    [NEW] icmp     1 30 src=128.1.227.61 
> > dst=xx.yy.zz.13 type=8 code=0 id=8724 [UNREPLIED] src=xx.yy.zz.13 
> > dst=128.1.227.61 type=0 code=0 id=8724 id=2525400839
> > [1780936563.343994]	 [UPDATE] icmp     1 30 src=128.1.227.61 
> > dst=xx.yy.zz.13 type=8 code=0 id=8724 src=xx.yy.zz.13 dst=128.1.227.61 
> > type=0 code=0 id=8724 id=2525400839
> > [1780936565.281121]	    [NEW] icmp     1 30 src=128.1.227.61 
> > dst=xx.yy.zz.11 type=8 code=0 id=8724 [UNREPLIED] src=xx.yy.zz.11 
> > dst=128.1.227.61 type=0 code=0 id=8724 id=2574615308
> > [1780936565.281167]	 [UPDATE] icmp     1 30 src=128.1.227.61 
> > dst=xx.yy.zz.11 type=8 code=0 id=8724 src=xx.yy.zz.11 dst=128.1.227.61 
> > type=0 code=0 id=8724 id=2574615308
> >
> > Here xx.yy.zz.11 and .13 are my public IP addresses. Why do these connections
> > show up in the conntrack --event --src-nat output? Thanks!
> 
> Unfortunately, it appears to be a bug affecting ICMP. Possibly here:
> 
> https://git.netfilter.org/libnetfilter_conntrack/tree/src/conntrack/objopt.c?id=7e5397b9167bdd7597be809b8f088ff333e1ad31#n189

Maybe then this helps?

https://patchwork.ozlabs.org/project/netfilter-devel/patch/20260610103039.167819-1-pablo@netfilter.org/