It becomes much harder to identify NAT when you also scrub out going packets, and change the packet IP identification field with a random-id. Other things that

It becomes much harder to identify NAT when you also scrub out going packets, and change the packet IP identification field with a random-id. Other things that help as well is to not load balance the TCP/IP connection, but rather terminate on the first machine, then pass the connection through using something like varnish/haproxy.