Forum Moderators: bakedjake

Message Too Old, No Replies

iftop not showing actual IPs

behind pound

         

LifeinAsia

4:27 pm on Apr 28, 2017 (gmt 0)

WebmasterWorld Administrator 10+ Year Member Top Contributors Of The Month



I've been using iftop for some time to monitor traffic on my web servers. However, after I started using pound as a proxy server, iftop only shows the IP of the pound server.

Is there a configuration I've missed somewhere? (Apache logging of the web servers logs the correct IPs.) Or do I have to resign myself to running iftop on the pound server?

lammert

1:05 am on Apr 29, 2017 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



iftop is a low level tool which looks at the IP addresses which make the connection to the webserver. If you use a proxy server, this will always be the IP address of that server. Apache can use an extra header in the HTTP protocol called X-Forwarded-For. If the proxy server sets this header--and apparently your pound server does--then Apache can determine the original server address and use it in its logs.

To catch the original IP addresses with iftop, you'll probably have to move it to the pound server.