Re: Logging SNAT'ed connections

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Mon, Jun 08, 2026 at 06:38:54PM +0200, Jan Kasprzak wrote:
> Hi all,
> 
> how do you log SNAT'ed connections for further forensic purposes,
> when somebody complains about your public IP address and you want to be
> able to find a local user behind NAT?
> 
> I used to run something like
> 
> conntrack --event --buffer-size 1600000 -o id,timestamp --src-nat >> $LOGFILE
> 
> which did what I want. But now I tried to run the same on AlmaLinux9 host,
> and it seems that --src-nat filter does not get applied - it shows
> even connections which are not SNAT'ed at all, because they are for my
> own IP address:
> 
> [1780936563.343940]	    [NEW] icmp     1 30 src=128.1.227.61 dst=xx.yy.zz.13 type=8 code=0 id=8724 [UNREPLIED] src=xx.yy.zz.13 dst=128.1.227.61 type=0 code=0 id=8724 id=2525400839
> [1780936563.343994]	 [UPDATE] icmp     1 30 src=128.1.227.61 dst=xx.yy.zz.13 type=8 code=0 id=8724 src=xx.yy.zz.13 dst=128.1.227.61 type=0 code=0 id=8724 id=2525400839
> [1780936565.281121]	    [NEW] icmp     1 30 src=128.1.227.61 dst=xx.yy.zz.11 type=8 code=0 id=8724 [UNREPLIED] src=xx.yy.zz.11 dst=128.1.227.61 type=0 code=0 id=8724 id=2574615308
> [1780936565.281167]	 [UPDATE] icmp     1 30 src=128.1.227.61 dst=xx.yy.zz.11 type=8 code=0 id=8724 src=xx.yy.zz.11 dst=128.1.227.61 type=0 code=0 id=8724 id=2574615308
> 
> Here xx.yy.zz.11 and .13 are my public IP addresses. Why do these connections
> show up in the conntrack --event --src-nat output? Thanks!

Could you check if this fixes the issue for you?

https://patchwork.ozlabs.org/project/netfilter-devel/patch/20260610103039.167819-1-pablo@netfilter.org/

Thanks.