How to detect nat'd packet

I am on a router-on-a-stick topology, so on the same interface I capture both incoming and outgoing packets. I noticed, in particular, that nat packets (i.e the original one, inbound, and the routed one, outbound) have the same ip.id value. Is there a way to have Wireshark automatically identify those packets to relate them and/or to inform about such information (i.e. this is the same packet of a previously seen one, just undergone a nat process)

M@xF@actor's avatar
16
M@xF@actor
asked 2021-10-08 04:44:50 +0000
edit flag offensive 0 remove flag close merge delete

Comments

I don't know all that much about it because I've never used it myself, but I wonder if this is something MATEcould help with? See also: https://gitlab.com/wireshark/wireshar...

cmaynard's avatar cmaynard (2021-10-08 21:43:07 +0000) edit

Uhm... very interesting anyway... Thanks, I'll keep you posted should I find the answer in there

M@xF@actor's avatar M@xF@actor (2021-10-09 04:01:17 +0000) edit
add a comment see more comments