On 11/11/2009 11:24:34 PM, JF Cliche wrote:
> Maybe a newbie question, so I'll be brief:
>
> I am behind two NAT routers (Linksys running DD-WRT) with port
> forwarding up to the machine running pmacct, and yet pmacct reports
> SSH traffic to the forwarded port with the public (external,
> non-NATed) addresses. I thought all traffic should be seen as coming
> from the second router private address. Is pmacct (or underlying pcab
> library) getting the public address from extra data encapsulated in
> the TCP packets by the routers or in the SSH protocol?
It's libpcap delivering the datagrams and I've always assumed it's
monitoring what's on the wire. I want it to.
Karl <k...@meme.com>
Free Software: "You don't pay back, you pay forward."
-- Robert A. Heinlein
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
