Re: Akamai WAF
Monah Baki <[email protected]> Thu, 18 Oct 2018 08:04:09 -0400
| Newsgroups | gmane.network.argus |
|---|---|
| Message-ID | <CALP3=x8tZXU-1pNQYMNR2mG3Fy-Yy+guwKYuuRTinja3-F8J_A@mail.gmail.com> |
--00000000000013d84305787f929f
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Morning Carter
My /etc/resolv.conf has the following local dns server
nameserver 172.16.64.44
nameserver 172.16.84.45
If I turn of name resolution in ratop I get the following (23.x.x.x) is
akamai:
2 07:59:22.790847 23.212.3.119.33852
US 172.16.90.80.https ZZ
s[50]=3D..................{....../............1.I.. ..c.i.
d[50]=3D....Y...U..[.u...\>...Q..7Z....[.v.=3D.....D. !.....
9 07:58:10.105559 23.212.3.111.40000
US 172.16.90.80.https ZZ s[50]=3D.....=3D^.....y...
.rC....%|.`k..l...~.Lw.Gv/}.irH._ d[50]=3D....+knR.?~..`c..............;=
..
...$..]f.#.......
9 07:58:10.098356 23.212.3.119.61694
US 172.16.90.80.https ZZ
s[50]=3D.......jk.....J&pfg...f.5..F.L1.\....m.....$..R..k
d[50]=3D....*.,.Q......6..w....|.8....Ll..'......du...sF..
9 07:58:10.107991 23.212.3.111.40003
US 172.16.90.80.https ZZ
s[50]=3D.....%..."+K....w].g^....Y.q..;.......j.:~..|Gy}0.
d[50]=3D....*.M.c..'.O....k.....U....#..PQ.7W.&..y._N..z.?
1 08:00:52.113364 23.48.209.87.37265
US 172.16.90.80.https ZZ
s[50]=3D..............a.T..5_8..4|.....W....+Q/.8.. ...lz.
d[50]=3D....Y...U..[.u..M...__w6LW..H.2...nB..{C... ..S..Z
1 08:00:52.113383 23.48.209.87.37264
US 172.16.90.80.https ZZ
s[50]=3D................Ku.......&B.4.;....S..N.?.* ...lz.
d[50]=3D....Y...U..[.u........ln..Nf...U....y...Nt| ....\.
1 08:00:52.114270 23.48.209.87.37267
US 172.16.90.80.https ZZ s[50]=3D...........W..J....."G.......Jh..
.A....~.. ...lz. d[50]=3D....Y...U..[.u......3K...S."L.*..G.....e7 . ..\=
...
1 08:00:52.114281 23.48.209.87.37271
US 172.16.90.80.https ZZ
s[50]=3D.............:}@MY..Q.tg....AIk.....-9$.{.. ...lz.
d[50]=3D....Y...U..[.u....e.8.".X.....2Z..4.`..p.i. .....@
1 08:00:52.114303 23.48.209.87.37268
US 172.16.90.80.https ZZ
s[50]=3D..............09`%x<V/.......^qB2..1.....*. ...lz.
d[50]=3D....Y...U..[.u.B/.*n0i..$.i..yA9.H.>Pg9.l.X .C~..7
Thanks
Monah
On Thu, Oct 18, 2018 at 4:28 AM Carter Bullard <[email protected]> wrote:
> Hey Monah,
> The name is coming from ratop.1 doing a reverse lookup of the address fro=
m
> the DNS server you are configured to use. Turn off name resolution to se=
e
> what IP address argus is reporting, then point your system DNS to a serve=
r
> that will give you local names.
>
> Carter
> [image: QoSient] <http://qosient.com/>
> Carter Bullard <[email protected]>=E2=80=A2 CTO
> 150 E 57th Street Suite 12D
> New York, New York 10022-2795
> Phone +1.212.588.9133 =E2=80=A2 Mobile +1.917.497.9494
>
> On Oct 17, 2018, at 6:47 PM, Monah Baki <[email protected]> wrote:
>
> Hi all,
>
> We are using akamai WAF services to protect our webserver. Currently
> running the latest argus/client on the webserver. When running ratop, the
> SrcAddr shows only the akamai IP (a23-212-3-119.deploy.static.akamaitechn=
*)
> hitting our webserver.
> Akamai confirmed True-Client-IP is enabled and we should be able to see
> the real IP in the request header. Can I get this info when using ratop?
>
>
> Trans StartTime SrcAddr Sport
> sCo DstAddr Dport dCo srcUdata
> dstUdata
> 14 12:42:39.209029 a23-212-3-119.deploy.static.akamaitechn*.49057
> US www.ntis.gov.https ZZ
> s[50]=3D............s~V-...Tl....x..`...<.#.4^.+..a ..+...
> d[50]=3D....Y...U..[.f...=3D...|.I....:.t..?..:Yc...& O.-G].
> 2 12:45:50.752456 a23-212-53-84.deploy.static.akamaitechn*.61219
> US www.ntis.gov.https ZZ
> s[50]=3D...........g.....E{.K.:S.4..4.e.F_..^.A."Rx o#Rr&3
> d[50]=3D....Q...M..[.g>.....*..... ....G.as.V..y..d o#Rr&3
>
>
> Thanks
> Monah
>
>
--00000000000013d84305787f929f
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><div di=
r=3D"ltr">Morning Carter<div><br></div><div>My /etc/resolv.conf has the fol=
lowing local dns server</div><div><div>nameserver 172.16.64.44<br></div><di=
v>nameserver 172.16.84.45</div></div><div><br></div><div>If I turn of name =
resolution in ratop I get the following (23.x.x.x) is akamai:</div><div><br=
></div><div><div>=C2=A0 =C2=A0 =C2=A02=C2=A0 =C2=A0 07:59:22.790847=C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A023.212.3.119.33852=C2=A0 =C2=A0US=C2=A0 =C2=A0 =C2=
=A0 =C2=A0172.16.90.80.https=C2=A0 =C2=A0ZZ s[50]=3D..................{....=
../............1.I.. ..c.i.=C2=A0 =C2=A0 d[50]=3D....Y...U..[.u...\>...Q=
..7Z....[.v.=3D.....D. !.....</div></div><div><div>=C2=A0 =C2=A0 =C2=A09=C2=
=A0 =C2=A0 07:58:10.105559=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A023.212.3.111.40000=
=C2=A0 =C2=A0US=C2=A0 =C2=A0 =C2=A0 =C2=A0172.16.90.80.https=C2=A0 =C2=A0ZZ=
s[50]=3D.....=3D^.....y... .rC....%|.`k..l...~.Lw.Gv/}.irH._=C2=A0 =C2=A0 =
d[50]=3D....+knR.?~..`c..............;.. ...$..]f.#.......</div><div>=C2=A0=
=C2=A0 =C2=A09=C2=A0 =C2=A0 07:58:10.098356=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A023=
.212.3.119.61694=C2=A0 =C2=A0US=C2=A0 =C2=A0 =C2=A0 =C2=A0172.16.90.80.http=
s=C2=A0 =C2=A0ZZ s[50]=3D.......jk.....J&pfg...f.5..F.L1.\....m.....$..=
R..k=C2=A0 =C2=A0 d[50]=3D....*.,.Q......6..w....|.8....Ll..'......du..=
.sF..</div><div>=C2=A0 =C2=A0 =C2=A09=C2=A0 =C2=A0 07:58:10.107991=C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A023.212.3.111.40003=C2=A0 =C2=A0US=C2=A0 =C2=A0 =C2=
=A0 =C2=A0172.16.90.80.https=C2=A0 =C2=A0ZZ s[50]=3D.....%..."+K....w]=
.g^....Y.q..;.......j.:~..|Gy}0.=C2=A0 =C2=A0 d[50]=3D....*.M.c..'.O...=
.k.....U....#..PQ.7W.&..y._N..z.?</div><div>=C2=A0 =C2=A0 =C2=A01=C2=A0=
=C2=A0 08:00:52.113364=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A023.48.209.87.37265=C2=
=A0 =C2=A0US=C2=A0 =C2=A0 =C2=A0 =C2=A0172.16.90.80.https=C2=A0 =C2=A0ZZ s[=
50]=3D..............a.T..5_8..4|.....W....+Q/.8.. ...lz.=C2=A0 =C2=A0 d[50]=
=3D....Y...U..[.u..M...__w6LW..H.2...nB..{C... ..S..Z</div></div><div><div>=
=C2=A0 =C2=A0 =C2=A01=C2=A0 =C2=A0 08:00:52.113383=C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A023.48.209.87.37264=C2=A0 =C2=A0US=C2=A0 =C2=A0 =C2=A0 =C2=A0172.16.90=
.80.https=C2=A0 =C2=A0ZZ s[50]=3D................Ku.......&B.4.;....S..=
N.?.* ...lz.=C2=A0 =C2=A0 d[50]=3D....Y...U..[.u........ln..Nf...U....y...N=
t| ....\.</div><div>=C2=A0 =C2=A0 =C2=A01=C2=A0 =C2=A0 08:00:52.114270=C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A023.48.209.87.37267=C2=A0 =C2=A0US=C2=A0 =C2=A0 =
=C2=A0 =C2=A0172.16.90.80.https=C2=A0 =C2=A0ZZ s[50]=3D...........W..J.....=
"G.......Jh.. .A....~.. ...lz.=C2=A0 =C2=A0 d[50]=3D....Y...U..[.u....=
..3K...S."L.*..G.....e7 . ..\...</div><div>=C2=A0 =C2=A0 =C2=A01=C2=A0=
=C2=A0 08:00:52.114281=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A023.48.209.87.37271=C2=
=A0 =C2=A0US=C2=A0 =C2=A0 =C2=A0 =C2=A0172.16.90.80.https=C2=A0 =C2=A0ZZ s[=
50]=3D.............:}@MY..Q.tg....AIk.....-9$.{.. ...lz.=C2=A0 =C2=A0 d[50]=
=3D....Y...U..[.u....e.8.".X.....2Z..4.`..p.i. .....@</div><div>=C2=A0=
=C2=A0 =C2=A01=C2=A0 =C2=A0 08:00:52.114303=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A023=
.48.209.87.37268=C2=A0 =C2=A0US=C2=A0 =C2=A0 =C2=A0 =C2=A0172.16.90.80.http=
s=C2=A0 =C2=A0ZZ s[50]=3D..............09`%x<V/.......^qB2..1.....*. ...=
lz.=C2=A0 =C2=A0 d[50]=3D....Y...U..[.u.B/.*n0i..$.i..yA9.H.>Pg9.l.X .C~=
..7</div><div><br></div></div><div><br></div><div>Thanks</div><div>Monah</d=
iv></div></div></div></div></div><br><div class=3D"gmail_quote"><div dir=3D=
"ltr">On Thu, Oct 18, 2018 at 4:28 AM Carter Bullard <<a href=3D"mailto:=
[email protected]">[email protected]</a>> wrote:<br></div><blockquote =
class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid=
;padding-left:1ex"><div dir=3D"auto">Hey Monah,<div>The name is coming from=
ratop.1 doing a reverse lookup of the address from the DNS server you are =
configured to use.=C2=A0 Turn off name resolution to see what IP address ar=
gus is reporting, then point your system DNS to a server that will give you=
local names.</div><div><br>Carter<br><div id=3D"m_-5876559818222816043Appl=
eMailSignature" dir=3D"ltr"><table id=3D"m_-5876559818222816043sig" width=
=3D"360" cellspacing=3D"0" cellpadding=3D"0" style=3D"font-family:UICTFontT=
extStyleBody;font-size:13pt;width:360px;margin:0px;padding:0px"><tbody><tr>=
<td width=3D"142" style=3D"width:142px;margin:0px;padding:0px"><a href=3D"h=
ttp://qosient.com/" title=3D"QoSient" style=3D"text-decoration:none;border:=
none;color:rgb(149,79,114)" target=3D"_blank"><img alt=3D"QoSient" style=3D=
"border:none;height:48px;line-height:48px;font-size:48px;font-family:'G=
ill Sans',sans-serif;color:rgb(0,0,0)"></a></td><td width=3D"20" style=
=3D"width:16px;min-width:16px;max-width:16px;margin:0px;padding:0px">=C2=A0=
</td><td style=3D"margin:0px;padding:0px;border-collapse:collapse"><table i=
d=3D"m_-5876559818222816043sig2" cellspacing=3D"0" cellpadding=3D"0"><tbody=
><tr><td style=3D"white-space:nowrap;font-family:'Gill Sans Light',=
sans-serif"><a href=3D"mailto:[email protected]" style=3D"text-decoration:=
none;border:none;color:rgb(149,79,114)" target=3D"_blank"><span style=3D"li=
ne-height:16px;font-size:16px;color:rgb(0,0,176)">Carter Bullard</span>=C2=
=A0</a><span style=3D"line-height:14px;font-size:12px">=E2=80=A2</span>=C2=
=A0<span style=3D"line-height:14px;font-size:12px">CTO</span></td></tr><tr>=
<td style=3D"white-space:nowrap;font-family:'Gill Sans Light',sans-=
serif"><span style=3D"line-height:14px;font-size:12px">150 E 57th Street Su=
ite=C2=A012D</span></td></tr><tr><td style=3D"white-space:nowrap;font-famil=
y:'Gill Sans Light',sans-serif"><span style=3D"line-height:14px;fon=
t-size:12px">New York, New York 10022-2795</span></td></tr><tr><td style=3D=
"white-space:nowrap;font-family:'Gill Sans Light',sans-serif"><span=
style=3D"line-height:12px;font-size:12px">Phone +1.212.588.9133=C2=A0=E2=
=80=A2 Mobile +1.917.497.9494<br></span></td></tr></tbody></table></td></tr=
></tbody></table></div><div dir=3D"ltr"><br>On Oct 17, 2018, at 6:47 PM, Mo=
nah Baki <<a href=3D"mailto:[email protected]" target=3D"_blank">monah=
[email protected]</a>> wrote:<br><br></div><blockquote type=3D"cite"><div d=
ir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr">Hi all,<div><=
br></div><div>We are using akamai WAF services to protect our webserver. Cu=
rrently running the latest argus/client on the webserver. When running rato=
p, the SrcAddr shows only the akamai IP (a23-212-3-119.deploy.static.akamai=
techn*) hitting our webserver.=C2=A0</div><div>Akamai confirmed True-Client=
-IP is enabled and we should be able to see the real IP in the request head=
er. Can I get this info when using ratop?</div><div><br></div><div><br></di=
v><div><div>Trans=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 StartTime=C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 SrcAddr=C2=A0 Sport sCo=C2=A0 =C2=A0 =C2=A0=
=C2=A0 =C2=A0 =C2=A0 DstAddr=C2=A0 Dport dCo=C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 srcUdata=C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 dstUdata</div><div>=C2=A0 =C2=A0 14=C2=A0 =
=C2=A0 12:42:39.209029 a23-212-3-119.deploy.static.akamaitechn*.49057=C2=A0=
=C2=A0US=C2=A0 =C2=A0 =C2=A0 =C2=A0<a href=3D"http://www.ntis.gov.https" t=
arget=3D"_blank">www.ntis.gov.https</a>=C2=A0 =C2=A0ZZ s[50]=3D............=
s~V-...Tl....x..`...<.#.4^.+..a ..+...=C2=A0 =C2=A0 d[50]=3D....Y...U..[=
.f...=3D...|.I....:.t..?..:Yc...& O.-G].<br></div><div>=C2=A0 =C2=A0 =
=C2=A02=C2=A0 =C2=A0 12:45:50.752456 a23-212-53-84.deploy.static.akamaitech=
n*.61219=C2=A0 =C2=A0US=C2=A0 =C2=A0 =C2=A0 =C2=A0<a href=3D"http://www.nti=
s.gov.https" target=3D"_blank">www.ntis.gov.https</a>=C2=A0 =C2=A0ZZ s[50]=
=3D...........g.....E{.K.:S.4..4.e.F_..^.A."Rx o#Rr&3=C2=A0 =C2=A0=
d[50]=3D....Q...M..[.g>.....*..... ....G.as.V..y..d o#Rr&3</div></d=
iv><div><br></div><div><br></div><div>Thanks</div><div>Monah</div></div></d=
iv></div>
</div></blockquote></div></div></blockquote></div>
--00000000000013d84305787f929f--