The Network Address Translated IP from which activity originated (for example, attacker or client).
Data Type
IP
Aliases
|
Use |
Alias |
|---|---|
|
Client Console Full Name |
NAT IP Address (Origin) |
|
Client Console Short Name |
Not applicable |
|
Web Console Tab/Name |
NAT IP Address (Origin) |
|
Elasticsearch Field Name |
originNatIp |
|
Rule Builder Column Name |
SNATIP |
|
Regex Pattern |
<snatip> |
|
NetMon Name |
Not applicable |
Field Relationships
- SIP
- SIPv4
- SIPv6
- SIPv6E
- Origin Hostname
- Origin Hostname or IP
- DIP
- DIPv4
- DIPv6
- DIPv6E
- Impacted Hostname
- Impacted Hostname or IP
- Impacted NAT IP
- Origin Port
- Origin NAT Port
- Impacted Port
- Impacted NAT Port
- Origin MAC Address
- Impacted MAC Address
- Origin Interface
- Impacted Interface
- Origin Domain
- Impacted Domain
- Origin Login
- Impacted Account
- IANA Protocol Number
- IANA Protocol Name
Common Applications
Network equipment
Use Case
Internal host context
MPE/Data Masking Manipulations
Polyfield – Origin Host
Usage Standards
-
Do not override/overload, use <snatip> not (?<snatip>.*?).
-
NAT Origin is Client (In Client-Server Model).
-
NAT Origin is Attacker (In Attacker-Target Model).
-
Use when you see an Origin IP address IPv4 or IPv6.
Examples
-
Cisco Netflow
02 19 2014 06:40:29 NetFlow V9 CONN_ID=- Src=1.1.1.1 SPort=62173 InIfc=4 Dst=1.1.1.1 DPort=8080 OutIfc=3 Prot=6 ICMP_IPV4_TYPE=- ICMP_IPV4_CODE=- XLATE_SRC_ADDR_IPV4=- XLATE_DST_ADDR_IPV4=- XLATE_SRC_PORT=- XLATE_DST_PORT=- FW_EVENT=- FW_EXT_EVENT=- EVENT_TIME_MSEC=- IN_PERMANENT_BYTES=- DETAILS=CONN_ID=1632431052 ICMP_IPV4_TYPE=0 ICMP_IPV4_CODE=0 XLATE_SRC_ADDR_IPV4=1.1.1.1 XLATE_DST_ADDR_IPV4=1.1.1.1 XLATE_SRC_PORT=61695 XLATE_DST_PORT=8080 FW_EVENT=2 FW_EXT_EVENT=2015 EVENT_TIME_MSEC=1392835229440 IN_PERMANENT_BYTES=8807 DefaultDevice TemplateID=263
XLATE-SRC-ADDR indicates an origin IP (source in a network context) utilizing Network Address Translation (NAT). SIP and DIP (Origin and Impacted) are indicated here with src= and dst=.