detect usage of NAT/PAT behind single IP

[mischadiehm]

What would you like to add or change?:
Detect NAT usage behind a single IP using NetFlow/PCAP/.. data. This would help identify unauthorized network extensions, such as when a device on an access port performs NAT. Potential methods include analyzing TTL distributions, ephemeral port usage, and device fingerprints (e.g., TCP window sizes) to statistically identify multiple hosts behind one IP.

Why do you and others need this?:
This could be a valuable check for compliance or security reasons.

[rafal-almusawi]

that will be a great feature, that will help prevent ppl to share their connection, prove bad performance because of the heavy number of concurrent devices

any time line for that ?