search

aabc / ipt-netflow

Netflow iptables module for Linux kernel (official)
https://github.com/aabc/ipt-netflow
511 stars 129 forks source link

Missing postNAT fields in netflow v9 flow records #175

Open gnought opened 3 years ago

gnought commented 3 years ago

Adding netflow capture on PREROUTING and POSTROUTING chains, I found that the netflow v9 flow record does not contain postNAT fields. They are only in NAT events.

Is it by design? Can those fields be added to get pre-snat and post-dnat information in flow records?

aabc commented 3 years ago

This is consequence of what information is available at the time of reporting a flow (in the iptables target).