check for NAT faking log entry