Re: Logging SNAT'ed connections

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Wed, Jun 10, 2026 at 01:04:54PM +0100, Kerin Millar wrote:
> On Wed, 10 Jun 2026, at 12:18 PM, Pablo Neira Ayuso wrote:
> > On Mon, Jun 08, 2026 at 06:53:30PM +0100, Kerin Millar wrote:
> >> On Mon, 8 Jun 2026, at 5:38 PM, Jan Kasprzak wrote:
> >> > Hi all,
> >> >
> >> > how do you log SNAT'ed connections for further forensic purposes,
> >> > when somebody complains about your public IP address and you want to be
> >> > able to find a local user behind NAT?
> >> >
> >> > I used to run something like
> >> >
> >> > conntrack --event --buffer-size 1600000 -o id,timestamp --src-nat >> $LOGFILE
> >> >
> >> > which did what I want. But now I tried to run the same on AlmaLinux9 host,
> >> > and it seems that --src-nat filter does not get applied - it shows
> >> > even connections which are not SNAT'ed at all, because they are for my
> >> > own IP address:
> >> >
> >> > [1780936563.343940]	    [NEW] icmp     1 30 src=128.1.227.61 
> >> > dst=xx.yy.zz.13 type=8 code=0 id=8724 [UNREPLIED] src=xx.yy.zz.13 
> >> > dst=128.1.227.61 type=0 code=0 id=8724 id=2525400839
> >> > [1780936563.343994]	 [UPDATE] icmp     1 30 src=128.1.227.61 
> >> > dst=xx.yy.zz.13 type=8 code=0 id=8724 src=xx.yy.zz.13 dst=128.1.227.61 
> >> > type=0 code=0 id=8724 id=2525400839
> >> > [1780936565.281121]	    [NEW] icmp     1 30 src=128.1.227.61 
> >> > dst=xx.yy.zz.11 type=8 code=0 id=8724 [UNREPLIED] src=xx.yy.zz.11 
> >> > dst=128.1.227.61 type=0 code=0 id=8724 id=2574615308
> >> > [1780936565.281167]	 [UPDATE] icmp     1 30 src=128.1.227.61 
> >> > dst=xx.yy.zz.11 type=8 code=0 id=8724 src=xx.yy.zz.11 dst=128.1.227.61 
> >> > type=0 code=0 id=8724 id=2574615308
> >> >
> >> > Here xx.yy.zz.11 and .13 are my public IP addresses. Why do these connections
> >> > show up in the conntrack --event --src-nat output? Thanks!
> >> 
> >> Unfortunately, it appears to be a bug affecting ICMP. Possibly here:
> >> 
> >> https://git.netfilter.org/libnetfilter_conntrack/tree/src/conntrack/objopt.c?id=7e5397b9167bdd7597be809b8f088ff333e1ad31#n189
> >
> > Maybe then this helps?
> >
> > https://patchwork.ozlabs.org/project/netfilter-devel/patch/20260610103039.167819-1-pablo@netfilter.org/
> 
> I have not yet tried it but shouldn't the helper function be checking against the protonum field? Also, the referenced commit appears unrelated to the fix. I think it should refer to b4c3a23c884c.

Thanks for reviewing, v2 is here:

https://patchwork.ozlabs.org/project/netfilter-devel/patch/20260610151735.192168-1-pablo@netfilter.org/