Look into SO_ORIGINAL_DST for finding original IP addresses

[justfalter]

SO_ORIGINAL_DST for Linux systems:
Squid uses it here: https://github.com/schmurfy/squid/blob/a33e4089e463d175014d57afed74d3897a7de02d/src/ip/IpIntercept.cc

redsocks uses it here (apparently lifted from squid) https://github.com/darkk/redsocks/blob/master/base.c

SIOCGNATL for BSD systems:
http://www.unix.com/man-page/all/7i/ipnat/
http://docs.oracle.com/cd/E19253-01/816-5177/6mbbc4g6m/

[RajUmadas]

this is how we evolved mallory.

https://github.com/RajUmadas/mallory/blob/master/src/netfilter.py