How to detect nat'd packet

asked 2021-10-08 04:44:50 +0000

M@xF@actor gravatar image

I am on a router-on-a-stick topology, so on the same interface I capture both incoming and outgoing packets. I noticed, in particular, that nat packets (i.e the original one, inbound, and the routed one, outbound) have the same ip.id value. Is there a way to have Wireshark automatically identify those packets to relate them and/or to inform about such information (i.e. this is the same packet of a previously seen one, just undergone a nat process)

edit retag flag offensive close merge delete

Comments

I don't know all that much about it because I've never used it myself, but I wonder if this is something MATEcould help with? See also: https://gitlab.com/wireshark/wireshar...

cmaynard gravatar imagecmaynard ( 2021-10-08 21:43:07 +0000 )edit

Uhm... very interesting anyway... Thanks, I'll keep you posted should I find the answer in there

M@xF@actor gravatar imageM@xF@actor ( 2021-10-09 04:01:17 +0000 )edit