Re: Akamai WAF
Carter Bullard <[email protected]> Thu, 18 Oct 2018 10:28:00 +0200
| Newsgroups | gmane.network.argus |
|---|---|
| Message-ID | <[email protected]> |
--Apple-Mail-F6E5D33E-C065-438D-B078-1A010D4BAB41 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hey Monah, The name is coming from ratop.1 doing a reverse lookup of the address from t= he DNS server you are configured to use. Turn off name resolution to see wh= at IP address argus is reporting, then point your system DNS to a server tha= t will give you local names. Carter =09 Carter Bullard =E2=80=A2 CTO 150 E 57th Street Suite 12D New York, New York 10022-2795 Phone +1.212.588.9133 =E2=80=A2 Mobile +1.917.497.9494 > On Oct 17, 2018, at 6:47 PM, Monah Baki <[email protected]> wrote: >=20 > Hi all, >=20 > We are using akamai WAF services to protect our webserver. Currently runni= ng the latest argus/client on the webserver. When running ratop, the SrcAddr= shows only the akamai IP (a23-212-3-119.deploy.static.akamaitechn*) hitting= our webserver.=20 > Akamai confirmed True-Client-IP is enabled and we should be able to see th= e real IP in the request header. Can I get this info when using ratop? >=20 >=20 > Trans StartTime SrcAddr Sport s= Co DstAddr Dport dCo srcUdata = dstUdata > 14 12:42:39.209029 a23-212-3-119.deploy.static.akamaitechn*.49057 = US www.ntis.gov.https ZZ s[50]=3D............s~V-...Tl....x..`...<.= #.4^.+..a ..+... d[50]=3D....Y...U..[.f...=3D...|.I....:.t..?..:Yc...& O.= -G]. > 2 12:45:50.752456 a23-212-53-84.deploy.static.akamaitechn*.61219 = US www.ntis.gov.https ZZ s[50]=3D...........g.....E{.K.:S.4..4.e.F_= ..^.A."Rx o#Rr&3 d[50]=3D....Q...M..[.g>.....*..... ....G.as.V..y..d o#Rr= &3 >=20 >=20 > Thanks > Monah --Apple-Mail-F6E5D33E-C065-438D-B078-1A010D4BAB41 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable <html><head><meta http-equiv=3D"content-type" content=3D"text/html; charset=3D= utf-8"></head><body dir=3D"auto">Hey Monah,<div>The name is coming from rato= p.1 doing a reverse lookup of the address from the DNS server you are config= ured to use. Turn off name resolution to see what IP address argus is r= eporting, then point your system DNS to a server that will give you local na= mes.</div><div><br>Carter<br><div id=3D"AppleMailSignature" dir=3D"ltr"><tab= le id=3D"sig" width=3D"360" cellspacing=3D"0" cellpadding=3D"0" border-spaci= ng=3D"0" class=3D"" style=3D"font-family: UICTFontTextStyleBody; -webkit-tex= t-size-adjust: auto; font-size: 13pt; width: 360px; margin: 0px; padding: 0p= x;"><tbody class=3D""><tr class=3D""><td width=3D"142" class=3D"" style=3D"w= idth: 142px; margin: 0px; padding: 0px;"><a href=3D"http://qosient.com/" tit= le=3D"QoSient" class=3D"" style=3D"text-decoration: none; border: none; colo= r: rgb(149, 79, 114);"><img src=3D"data:image/png;base64,iVBORw0KGgoAAAANSUh= EUgAAAR8AAABdCAYAAACcsGKeAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAA= ACy9JREFUeNrsndt140YShmt85n2RgbERCI5gMBEMNgLBEZiOQHAEtCOgHIFGEZCKgNoIyI2AzMA= rnGkcy5jqC9DVF4D/dw4eRElEo6vr7+oLqokAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA= AAAAAAMBN8CGTctSaz1/frivMlJTi7apGn53VBcBixKdW193bVTKNWsfQ2F/eroO6QDixad+uT8p= WheFvX9U12OUs2Ebe2/4RZgFzaN6u3dt1ebv+EryelJMUqGIRSmUnH5scBWzSjb5zD9OAqb1n34h= OwoLDXRflNCWqXczhJWyynWkTiA/wasiXCKLDXTtEQpM7iWPgjqGB+IAY8zmukc5e9Yyt+r/S8J2= NapBPjqLW/80G5rBSWex1Ujbi7FMpu2wdxKuD+ICQbCPO0dSOc0h7REHGiOdiEJ12xnyRbpgN8QH= JwvZQ8zHDqszJEgVVMNN3HA228mVsE4gPiB627ynOJHBB9gnTFubSOneoOhpEaKr41Op/hgu2y48= yZadeGcL2S6IGU1qiMDTib3XE1c02YMeAyHN9beiSKiI1Cc+R0i957yBAk+rmCH8CM6ZZ9ilufqH= 8J3hbgwA1N9x4ONvV8Ckwo/OKLj4hJypjCdCtTkLXxK9sAeA64km2ELA1RDy50hqGh7e2DN9RvLk= esP7Oa5/qxkty4o7iTrLmyhNhDgwsUHxOmuFLuWDH++vGhl97wnwPyEh8fnCMHDiR+ZmWk9OlL+t= VM5QEACTAJj79kOoX5vOv6loKvfD8qlHzW+798foJyFZ8NpoG+usCn/WR+CRkDzdiay5KxQZAkC3= cXM9uwc9T0+3O/XSEDYZAzne853w+Gn7Xb8Yrmc9/W3AF9pHPKyM29+rzGFRMNBkjV/WBifIq1ag= ON+5Y3GsgueYPrxdSTiumHM59hNOOPuvnef6z8IbWMtFbPyT5d6D79SL+RTXuykEgXlQ9hxDDCyN= 8/T0/Z+Zc9cg2j8L3KEd20c19XVX9PCubSDl5Z/l53EHcqzqpLOV8UXV1negPpcPf/TjSg94uf07= o+CZ1cNyQaw2vJhQRhl4l+eetPpL8PpyOZBJ+xRwe7gPYxSddr8Qk/fi7daKzn1nObkI59xQ+w+i= k9lVpvmQtcBW+ERK2TthwJ5JbkTO9m9etXHyk7CKRKdPmV51Qu6lyFp+PBvHhQqe18MI4dH9UzO+= eczk7B4NfmSFVbemt96psvquM/b37PU9PzO8eVB0saf+Wq+A+OQj4wdEm/ff1+8PulD2k51t2loj= XtZylip5/tgxbXyfUY2Vpxzomtacu89BcYl5BcuWnIXN+o536m8IiXhsy5ySSyhywFQzbc458TJk= 2hxzVlUX4N6RPmjf39SJd5LPTlLOzlLNSz6Jrg3UAnwn2esWe1p2KohAcVrYBnLg2hMNS79PZ5j5= SiZCU+OiE5zKzI201zn0UEp8d+SflKzR2vZBM7vRk4lPTuuAcrvA0iHQK2Y1gg5/iUNzermZh4vO= kqTefhYVSI2hbz7bXCEe4G5LfnxdNfCQcM3eOngJbahxXehOmLnOk1HtpJbmvAA1DgDJz8dkEjBh= 1k/a1h39dArQfTnzLpYrP2vCN7vYUb/d3ReGzEE4RoeFZ6wzFhxMH6QwMNfklZjPVqeTUwkXw+yE= +mYgPN8/zFLi8vg1+igh15L5HSXo/kq/47CjOfCV3n9bDv0I485YRYYjPwsXnxIhAjGFpR3ETgrX= kvg/kJFQWH/EpKF6mzdKjAwoxIexaxgris1zxaSntSuCJ4udhLlUv6nIctu9ku4/4bCjuQgk3r1L= M8K8mYnvZ5C4+F+HJqhw5zXzGPaV9Mzy1+LlEQz5J+n3E5xhZmOfaImbHPhbILhfx0eXzedX0fmu= Ce56zw/+Me9I/Ipf7kSnnl8j3/6yug2H4s6e4qUq4N9NDJ7zjvv9TZu38v7mWTyc+15WLzxzhIU0= InyKj41eHcoXmoARIl6K2oHhHZpNG6F4C3/PKtJvcckOdc3XCHxzVsuduReJTzTTSHeOAKXKpPDN= immofVh8J/aSJlocdtzGoHedkpK+SeWaIj/Cwq16R+Hya2UtWkXtWU9ThIqgxG/hnQ7tpI5ThXxl= 3bGCC+Oga91p2OTeOz2wbrqXMIHfNbFh8VQLE1ckDnB6M+WhoSFy60Ybks8ql6Jk4EZkjPq8Jn+N= 1FI2WGdTtcErIjqm3KnJ99e30T7j48sSHlOG4XMdLF5975rOvaAqiTv/AiGETWXz+R8hNvchhl84= h64WHt4Vm/uEZTUGUJSxBg4zF56zpOX5Z8PNy55CdEfmI8+wwZAUQHyPcMTktLXPlS3f66pRNguf= RzymjwMpStpSk2KQ6Xnn8Ee69bPE5aKKfJZ5xzp080E+QPnqIT6oGXmgiuFzI4RwpRFoLFx9d9NP= 3ut2CnrMhfnn9t4mOMiXxe0hqx2jjljhkYhsgKD69Ubk5kQdaxuTzcKoE56xTT6t4Yb47RQ/7hXm= WnE6tTLEf7FXT6YAFi0+P7v2dPeW98bAg/UFvc46hOWTSwBuHcqUWfIpcRm6v1j1cfPniM5z3xDl= 3rgJkerP695nOcGWiwNirfy1T37ltpuOGPOcI931mRLqEm68DXY5fqeTcksJzNJTV17FSnWnWP9e= J0uYTcoHLldQ6/m9HfpkMLxQp6ZUHMfP51EL1UedQryanzqGXKQ1llEokvie55FlT2JJfGtUYZWz= JL01oR/I5nDcQn3WIT2Fx7jpxuG86ObQKZNAY0R/n1FMbwCWwIxaaqGdKWg1f8dEdbRNDeCvH+6x= BfE6pnNwkQCmOVi7IfgSwdOPbRhSgRuiZpA81tEWEc6LNjsKc2xU6Ot1M6HzXID5J87rbBOgUKQp= qyZzYPFSj0z2/tAC1mudqZ3wX10lIHaS3E+qIOiFn0Qmh9OpkObrXLYlPmVqAbNni9hRmOdomOhL= H47o0vEug4acpmpubHTDEmeymObY5DV1KfEyd41ZAdAvizzdbq/gUFPfYptkNRhcJbT2dslGO53K= gnUQDcx3nXwzOV88wcmv4Tp+0pLYTJ7YTxLq0DHXnRoBS4mPqHN6fM1bMsPfW8L1rFR8ifqW1cLR= DRwHnGyvLMIxzzK0qVKMq6f3VqN/tyP3guqFC6sjia3v2QXgbjXPXyhFswrqNZKOTKks3skmrPjs= 62GCu8EuKjy0yG0R3R/oXpoe26HJumatzLVV8OtKfWFsy992MRkZdaEd0GQ6FuKROzAw5BJ17Sc9= VtOR+HPLUa+cZcUqLT2jbDGWcMrxfqvjY5nltVxfLGVvPgrpeT5TXOzy1sPj6OrOpIW0Ey3oSskM= I8Xk/bJe0zXHmMy9VfGzTDNmIz3iMfBIWnA3lvXW+nThc5IYCsZ6v8YgMTsQnactRfCQ6xsE2PkP= 7JYvPnEjyRMyixofIDlnS3xuxPhF/yuSY/m3lM307S+xAy8vLWyjnvnv37AXzjP17Yy8ZPGNjsc9= 7e3wl+VQe5Uh0rxQuXUj5zjalRlAOqgyS7a9m7hGy/VWB6rP/3nv6Pr3yWV0vgdqIKNtIcx0AAMD= 2uKYl6xJVBAAIOSwzjcVj7d0BANwoHZkn/DqIEAAgZBRkWy3qVx18Xp9oIGIAAJNA2Jbph6W8Ka8= GDC9CdqhiAOLzYUFlbYk/hnfMsJT4Qt8vKw5LyMMKWv+7z5RX8nUAQMYiJLFzekp2PQAA+EcU4/q= Ge+zEUgCAG2FIteH6CkeLKgMAhIiINkqMuOFZhyoCID0fbuQ5a/o2v1PS9FNKAQAAAAAAAAAAAAA= AAAAAAAAAAAAASM3/BRgAaVGndQa4eeAAAAAASUVORK5CYII=3D" alt=3D"QoSient" class=3D= "" style=3D"border: none; height: 48px; line-height: 48px; font-size: 48px; f= ont-family: 'Gill Sans', sans-serif; color: rgb(0, 0, 0);"></a></td><td widt= h=3D"20" class=3D"" style=3D"width: 16px; min-width: 16px; max-width: 16px; m= argin: 0px; padding: 0px;"> </td><td class=3D"" style=3D"margin: 0px; p= adding: 0px; border-collapse: collapse;"><table id=3D"sig2" cellspacing=3D"0= " cellpadding=3D"0" border-spacing=3D"0" class=3D""><tbody class=3D""><tr cl= ass=3D""><td class=3D"" style=3D"white-space: nowrap; font-family: 'Gill San= s Light', sans-serif;"><a href=3D"mailto:[email protected]" class=3D"" styl= e=3D"text-decoration: none; border: none; color: rgb(149, 79, 114);"><span c= lass=3D"" style=3D"line-height: 16px; font-size: 16px; color: rgb(0, 0, 176)= ;">Carter Bullard</span> </a><span class=3D"" style=3D"line-height: 14p= x; font-size: 12px;">=E2=80=A2</span> <span class=3D"" style=3D"line-he= ight: 14px; font-size: 12px;">CTO</span></td></tr><tr class=3D""><td class=3D= "" style=3D"white-space: nowrap; font-family: 'Gill Sans Light', sans-serif;= "><span class=3D"" style=3D"line-height: 14px; font-size: 12px;">150 E 57th S= treet Suite 12D</span></td></tr><tr class=3D""><td class=3D"" style=3D"= white-space: nowrap; font-family: 'Gill Sans Light', sans-serif;"><span clas= s=3D"" style=3D"line-height: 14px; font-size: 12px;">New York, New York 1002= 2-2795</span></td></tr><tr class=3D""><td class=3D"" style=3D"white-space: n= owrap; font-family: 'Gill Sans Light', sans-serif;"><span class=3D"" style=3D= "line-height: 12px; font-size: 12px;">Phone +1.212.588.9133 =E2=80=A2 M= obile +1.917.497.9494<br></span></td></tr></tbody></table></td></tr></tbody>= </table></div><div dir=3D"ltr"><br>On Oct 17, 2018, at 6:47 PM, Monah Baki &= lt;<a href=3D"mailto:[email protected]">[email protected]</a>> wrote:= <br><br></div><blockquote type=3D"cite"><div dir=3D"ltr"><div dir=3D"ltr"><d= iv dir=3D"ltr"><div dir=3D"ltr">Hi all,<div><br></div><div>We are using akam= ai WAF services to protect our webserver. Currently running the latest argus= /client on the webserver. When running ratop, the SrcAddr shows only the aka= mai IP (a23-212-3-119.deploy.static.akamaitechn*) hitting our webserver.&nbs= p;</div><div>Akamai confirmed True-Client-IP is enabled and we should be abl= e to see the real IP in the request header. Can I get this info when using r= atop?</div><div><br></div><div><br></div><div><div>Trans = StartTime &nb= sp; SrcAddr&n= bsp; Sport sCo DstAddr Dport d= Co &nbs= p; srcUdata &n= bsp; &= nbsp; dstUdata</div><div>&n= bsp; 14 12:42:39.209029 a23-212-3-119.deploy.static.akam= aitechn*.49057 US <a href=3D"http://ww= w.ntis.gov.https">www.ntis.gov.https</a> ZZ s[50]=3D............= s~V-...Tl....x..`...<.#.4^.+..a ..+... d[50]=3D....Y...U..[.= f...=3D...|.I....:.t..?..:Yc...& O.-G].<br></div><div> &nbs= p;2 12:45:50.752456 a23-212-53-84.deploy.static.akamaitechn*.61= 219 US <a href=3D"http://www.ntis.gov.= https">www.ntis.gov.https</a> ZZ s[50]=3D...........g.....E{.K.:= S.4..4.e.F_..^.A."Rx o#Rr&3 d[50]=3D....Q...M..[.g>.....= *..... ....G.as.V..y..d o#Rr&3</div></div><div><br></div><div><br></div>= <div>Thanks</div><div>Monah</div></div></div></div> </div></blockquote></div></body></html>= --Apple-Mail-F6E5D33E-C065-438D-B078-1A010D4BAB41--