Ask Your Question

Revision history [back]

How to detect nat'd packet

I am on a router-on-a-stick topology, so on the same interface I capture both incoming and outgoing packets. I noticed, in particular, that nat packets (i.e the original one, inbound, and the routed one, outbound) have the same ip.id value. Is there a way to have Wireshark automatically identify those packets to relate them and/or to inform about such information (i.e. this is the same packet of a previously seen one, just undergone a nat process)