Hi,

My customers get private IP addresses which are translated to public addresses on the edge of the network. The translation is usually many private addresses to one public address using masquerade or srcnat actions.
In Poland network operators are obliged to keep information about IP address usage for one year in case of law infringements.
In case of src-nat it practically means keeping at least information about every established TCP session - source private IP and port and destination IP and port.
This is a well known situation, there also is a well known firewall filter rule which allows to log the TCP session info: Example of a log entry for a single TCP session: The log entry contains the private IP and port, here: 10.0.20.38:50173.
The question is: how to find out, what port number is the connection translated to on the public side?
I know I can sniff it on a port mirror of the uplink using tcpdump, but maybe there's a better solution.

Setting up the following ip firewall mangle rule: gives entries like this in the log: The part "NAT (10.0.20.101:38290->55.22.x.x:38290)" suggests, that the source port on the public side is the same, as on the public side, but it's not that way. How does that work? How are the public ports allocated? Is there a way to log it?

Thanks,
jacek

outgoing ports are assigned randomly by the router based on the availability.

Ok, so now I would like to know if it's possible to log the random port number for the tcp session.

I think your complicated your life a little bit here...
we have the same requirements in Spain and we supplied info to authorities on different occasions.
The important is to be able to provide info regarding who accessed what when... and the what and when will be provided.
No one cares about the outgoing ports!

set your mktk to send the connection logs to a syslog server and your covered.

cheers

I know I'm covered, but that's not enough for me. The police defines the source and destination IPs and ports. If I had consistent data, I would be able to make the process of finding the customer more automatic. Now I spend a lot of time searching through the logs.

Any ideas?

Normis? Sergejs? Anyone?