Nat changes from redhat 7.2

Hi.

I have written some software which I have been using for a while now that
reads the traffic flowing through my linux gateway. I am using NAT to share
the internet, and my programs opens a raw socket to read the traffic flowing
to each pc. In redhat 7.2 this worked fine, but in redhat 9.0 it seems the
NAT is done after i read the raw socket.

Eg. 9 (referring to inbound traffic only)

eth0 (10.0.0.50/24)
|
NAT
|
Read packet socket (dest of inbound packets are ips of client
machines off eth1)
|
eth1 (10.0.10.254/24)

Now in redhat 9.0, it seems to work like the following:

eth0 (10.0.0.50/24)
|
Read packet socket (dest of inbound packets is the ip of eth0)
|
NAT
|
eth1 (10.0.10.254/24)

Does anyone know how I can read the packet after the inbound packet has been
translated so I can read which terminal it is headed?


Thanks in advance.
Arron