Correlating protocol data units transiting networks with differing addressing schemes

A computer system for identifying associated communications between a first network with a first addressing scheme and a second network with a second addressing scheme, wherein a network address translator interposed between the first network and the second network translates between the first addressing scheme and the second addressing scheme, the system comprising:

• a first sensor, comprising an electronic processor, communicatively coupled to a first device in the first network to detect a first protocol data unit addressed from a first device in the first network in the first addressing scheme and addressed to a destination in the second network in the second addressing scheme, prior to translation of the first protocol data unit from the first addressing scheme to the second addressing scheme by the network address translator,
• wherein the first sensor is configured to insert, prior to translation from the first addressing scheme to the second addressing scheme by the network address translator, an additional protocol data unit comprising a breadcrumb protocol data unit that is addressed to the second network, the breadcrumb protocol data unit comprising, in a location subject to address translation by the network address translator, a source address of the first protocol data unit, the breadcrumb protocol data unit further comprising, in a location immune from address translation by the network address translator, the source address of the first protocol data unit;
• and
• a second sensor, comprising an electronic processor, communicatively coupled to the network address translator to receive a translated breadcrumb protocol data unit, wherein the translated breadcrumb data protocol unit comprises the breadcrumb data protocol unit after translation from the first addressing scheme to the second addressing scheme by the network address translator, wherein the translated breadcrumb protocol data unit comprises a translated source address of the first protocol data unit, wherein the translated source address of the first protocol data unit comprises the source address of the first protocol data unit after translation from the first addressing scheme to the second addressing scheme by the network address translator, wherein the translated breadcrumb protocol data unit does not ever reach the destination,
• wherein the computer system is configured to report an association of the source address of the first protocol data unit with the translated source address of the first protocol data unit.