Alright, just thought of a Linux related question to ask... ;-) I know there is a library (libiptc) that gives an interface to the netfilter tables that you can use directly from a program. Is there a similar library that gives you an interface to the connecttrack module and lets you see what packets are being DNATed and SNATed dynamically?