[Richard Molen <rmolen@xxxxxxxxxxxx>]

Where does ethereal (& presumably tcpdump) hook into the new Linux 
kernel 2.4.16 using netfilter & iptables?
Any help would be appreciated.

The netfilter documentation shows basically the following...

eth1 
>-|A|----PREROUTING-------ROUTING-------FORWARD---------POSTROUTING----|A|---> eth1
                                                              |         
                                     ^
                                                              |         
                                     |
                                                            IN         
                               OUT
                                                              |         
                                     |
                                                              
--------------local host-----------

When using 'ethereal' to monitor the interface to the ISP at eth1 at 
point '|A|', it seems that IP Masquerading is not mangling
the source address in the POSTROUTING hook for host1 traffic.  It seems 
to work fine from the local host though.

[ISP]------[<eth1>-|A|--local host--<eth0>]-----[host1]

Richard Molen