NAME

natlog - source-nat logging tool

SYNOPSIS

natlog [OPTIONS] command

DESCRIPTION

Firewalls like iptables(1) may offer POSTROUTING (source network address translation, snat) facilities changing the source address of a host behind the firewall to the address of the host connected to the outer world. With snat the following combinations of IP addresses and port numbers are encountered:

o: the IP address and port number used by the host protected by (i.e., behind) the firewall initiates a connection to the outer world (the source host, in this manual page referred to as IPsrc, sport);
o: the IP address and port number of the host outside (i.e., before) the firewall that IPsrc connects to (the destination host, in this manual page referred to as IPdst, dport);
o: the IP address and port number of the host where the firewall has been installed. This host performs the source natting, and its IP-address and the port it uses when forwarding IPsrc, sport’s requests to IPdst, dport are in this manual page referred to as IPfw, fwport. )

Source natting usually uses sport for fwport, but fwport may already be in use, in which case the firewalling host must use another, available port to forward communication from IPsrc, sport to IPdst, dport.

The general scheme that applies to source natting, therefore, looks like this:



    IPsrc:sport is translated by the firewall to IPfw:fwport;


    IPfw:fwport is used when communicating with IPdst:dport.

From the perspective of the destination host the communication originates at IPfw::fwport and consequently all communication (e.g., incident reports) sent by the systems administrator maintaining IPdst to IPfw’s systems administrator will refer to IPfw:fwport, rather than to IPsrc::sport.

Relating IPfw:fwport to IPsrc:sport is difficult when merely using the standard log facilities provided by iptables and natlog was developed to fill in that particular niche.

Natlog provides data about source natting in various forms. The standard logging mode consists of messages sent to the syslog daemon (cf., rsyslogd(8)) and/or to the standard output stream showing the essential characteristics of connections using source natting. Here is an example of a logged message (log-entries occupy single lines; the line-breaks below are to enhance readability):



    NATLOG: from 1338990672:55588 thru 1338990747:807100 (UTC): tcp


        192.168.19.72:4467 (via: 129.125.90.132:4467) to 


        to 200.49.219.180:443; sent: 802, received: 7669

The values 1338990672:55588 and 1338990747:807100 are time stamps showing the begin- and end-times in seconds:microseconds of a tcp connection since the beginning of the epoch (Jan 1, 1970, 0:00 UTC). Natlog offers the --time option for requesting human-readable time specifications like Nov 2 13:29:11 rather than time representations using seconds and micro seconds.

The next value (192.168.19.72:4467) represents IPsrc::sport. This is followed by 129.125.90.132:4467, representing IPfw:fwport. The third pair of values (200.49.219.180:443) represents IPdst:dport.

In this example, host 192.168.19.72, using port 4467, connected to host 200.49.219.180, port 443. To this latter host the connection appears to have originated from 129.125.90.132 port 4467. The log message allows us to associate this with the `real’ host and port from which the connection originated: 192.168.19.72:4467.

The final entries show the number of bytes that were sent by the source-host (IPsrc) and received from the destination-host (IPdst).

When natlog is terminated it can no longer track connections that are still open. If natlog was terminated (by a SIGINT or SIGTERM signal), then it logs a `terminating’ line, followed by an overview of all (potentially) still open connections. Those connections are flagged with a trailing ’(EOP)’ (end of program) log-element, and their end-times show natlog’s termination time. Incomplete connections show (EXPIRED).

In addition to the standard logs the option --log-data is available. This option requires the path to a file where information is logged in tabular form, which can easily be processed by statistical software like R(1). When specifying this option information will be appended to an existing file. When the log file does not yet exist it is created. The first line of the thus written log files names the columns of the table. The column names are (all on one line):



    type, srcNr, srcIP, srcPort, dstNr, dstIP, dstPort, 


        sent, recvd, begin,  end, beginTime, endTime, status

Most column labels will be self-explanatory. Type indicates the connection type, logged as icmp, tcp, or udp; srcNr and dstNr are the 32 bit numeric values of, respectively, the source host’s IP address and the destination host’s IP address (decimal representations); begin and end are the times in seconds since the beginning of the epoch, corresponding to the times displayed at, respectively, beginTime and endTime; status indicates the status of the logged connection information: ok indicates a connection that was normally completed; expired indicates that the connection was recognized, but was not normally completed; eop is used for connections that were still active by the time natlog terminates. When the status equals expired, the time entries show the times of receiving the first and last packets of that connection; when eop, then the end and endTime entries show natlog’s termination time.

Log entries look like this (each entry occupies one line, header line and logged data lines are right-aligned):



    tcp, 101820608,    192.168.17.6,        48886, 


        4012145084,  188.121.36.239,           80,       


               430,            2266,   1517387644,    1517387644, 


        Jan 31 08:34:04:318340, Jan 31 08:34:04:383170,  ok