natlog 2.04.01-1 (arm64 binary) in ubuntu kinetic

 Firewalls like iptables usually offer POSTROUTING source network address
 translation facilities changing the source address of a host behind the
 firewall to the address of the host before the firewall.
 .
 The standard log facilities provided by iptables do not easily allow
 associating addresses behind the firewall with their source-natted
 equivalents before the firewall. Natlog was designed to fill in that
 particular niche.
 .
 When running natlog, messages are sent to the syslog daemon and/or to the
 standard output stream showing the essential characteristics of the
 connection using source natting. Here is an example:
 .
 from Fri 8 22:30:10:55588 until Fri 8 22:40:43:807100: 192.168.19.72:4467
 (via: 129.125.90.132:4467) to 200.49.219.180:443
 .
 Natlog depends on facilities provided by iptables; work is in progress to
 generate logs using facilities offered by the pcap library.