Suppose you have 4 processes inside one network (no firewalls) and you see (hostnames A,B,C,D):

From A:1 -> C:3
From B:2 -> D:4

Therefore you know A is communicating with C and B with D.

Now suppose A,B are in Datacentrum 1 (D1) and C,D are in Datacentrum 2 (D2). D1 and D2 both have firewall. Now they are communicating, but you cannot see the link from netstat because there is something like

From A:1 -> D1 Firewall:X
From D2 Firewall:Q -> C:3
From B:2 -> D1 Firewall:Y
From D2 Firewall:W -> D:4

A is still communicating with C (port 1 to 3) and B with D (port 2 to 4). I would like to see "translated" version in netstat (A:1-C:3 amd B:2-D:4). I want to do this in my own code so I cannot use some other enterprise network software and no access to firewall is possible. Is this doable? Can I somehow extract this information from netstat?

  • 1
    You are talking about firewalls, but your example seems to imply NAT devices. Can you please clarify your setup? Jul 24 '15 at 11:45
  • Unfortunately I don't know yet. I'm just considering what's possible and what is not (as I don't have background in networks). I suppose that there will be NAT as a part of firewall.
    – A47-42
    Jul 24 '15 at 14:16
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 12 '17 at 3:47

If your firewall does NAT (it really doesn't have to do that to provide security! NAT != Security) then your session will look different on every segment:

  • In the first data centre you will have A:1 as source and D2-Firewall:Q as destination
  • After you pass D1-Firewall with NAT you will see D1-Firewall:X as source and D2-Firewall:Q as destination
  • After you pass D2-Firewall with NAT you will see D1-Firewall:X as source and C:3 as destination

NAT really messes up debugging and visibility. Depending on where you look the source and destination addresses and ports will be completely different... From D1 you will only see the D2 NAT box and everything behind it will be hidden, and vice versa.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.