Origin NAT Port

The Network Address Translated (NAT) port from which activity originated (for example, client or attacker port).

Data Type

Integer

Aliases

Field Relationships

• SIP

• SIPv4

• SIPv6

• SIPv6E

• Origin Hostname

• Origin Hostname or IP

• Origin NAT IP

• DIP

• DIPv4

• DIPv6

• DIPv6E

• Impacted Hostname

• Impacted Hostname or IP

• Impacted NAT IP

• Origin Port

• Origin NAT Port

• Impacted Port

• Impacted NAT Port

• Origin MAC Address

• Impacted MAC Address

• Origin Interface

• Impacted Interface

• Origin Domain

• Impacted Domain

• Origin Login

• Impacted Account

• IANA Protocol Number

• IANA Protocol Name

Common Applications

Any network connected application or device.

Use Case

Host and application contexts.

MPE/Data Masking Manipulations

Used to help in determining Application.

Usage Standards

• Use to indicate the Network Address Translated (NAT) origin port number associated with a client or attacker host where Origin is Client (In Client-Server Model).

• Origin is Attacker (In Attacker-Target Model).

Examples

• Cisco Netflow

02 19 2014 06:40:29 NetFlow V9 CONN_ID=- Src=1.1.1.1 SPort=62173 InIfc=4 Dst=1.1.1.1 DPort=8080 OutIfc=3 Prot=6 ICMP_IPV4_TYPE=- ICMP_IPV4_CODE=- XLATE_SRC_ADDR_IPV4=- XLATE_DST_ADDR_IPV4=- XLATE_SRC_PORT=- XLATE_DST_PORT=- FW_EVENT=- FW_EXT_EVENT=- EVENT_TIME_MSEC=- IN_PERMANENT_BYTES=- DETAILS=CONN_ID=1632431052 ICMP_IPV4_TYPE=0 ICMP_IPV4_CODE=0 XLATE_SRC_ADDR_IPV4=1.1.1.1 XLATE_DST_ADDR_IPV4=1.1.1.1 XLATE_SRC_PORT=61695 XLATE_DST_PORT=8080 FW_EVENT=2 FW_EXT_EVENT=2015 EVENT_TIME_MSEC=1392835229440 IN_PERMANENT_BYTES=8807 DefaultDevice TemplateID=263