If I forward intranet -> internet connections to a proxy program, how do I discover from within my proxy what was original internet destination? My manpage for getsockopt says that NAT options aren't documented yet, so I guess getsockopt is used for this? If so, where can I find some documentation? Programming is one side, but how does this look on network? Does it work only locally or is there some TCP option attached to SYN packet? Is the information transmitted by other means, like separate connection for accounting data? I know that squid does it, but I don't know how. I couldn't find a single resource for programmers on netfiler website, maybe it is impossible and I just overestimated squid?