Re: Akamai WAF
Carter Bullard <[email protected]> Thu, 18 Oct 2018 14:19:48 +0200
| Newsgroups | gmane.network.argus |
|---|---|
| Message-ID | <[email protected]> |
--Apple-Mail-E9BC6DE6-281F-4862-83CB-5D6087DFA797 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hey Monah, If those are the right IP addresses, then Its up to akamai if those DNS serv= ers will give you the right name. Carter =09 Carter Bullard =E2=80=A2 CTO 150 E 57th Street Suite 12D New York, New York 10022-2795 Phone +1.212.588.9133 =E2=80=A2 Mobile +1.917.497.9494 > On Oct 18, 2018, at 2:04 PM, Monah Baki <[email protected]> wrote: >=20 > Morning Carter >=20 > My /etc/resolv.conf has the following local dns server > nameserver 172.16.64.44 > nameserver 172.16.84.45 >=20 > If I turn of name resolution in ratop I get the following (23.x.x.x) is ak= amai: >=20 > 2 07:59:22.790847 23.212.3.119.33852 = US 172.16.90.80.https ZZ s[50]=3D..................{....../........= ....1.I.. ..c.i. d[50]=3D....Y...U..[.u...\>...Q..7Z....[.v.=3D.....D. !.= .... > 9 07:58:10.105559 23.212.3.111.40000 = US 172.16.90.80.https ZZ s[50]=3D.....=3D^.....y... .rC....%|.`k..l= ...~.Lw.Gv/}.irH._ d[50]=3D....+knR.?~..`c..............;.. ...$..]f.#...= .... > 9 07:58:10.098356 23.212.3.119.61694 = US 172.16.90.80.https ZZ s[50]=3D.......jk.....J&pfg...f.5..F.L1.\.= ...m.....$..R..k d[50]=3D....*.,.Q......6..w....|.8....Ll..'......du...sF.= . > 9 07:58:10.107991 23.212.3.111.40003 = US 172.16.90.80.https ZZ s[50]=3D.....%..."+K....w].g^....Y.q..;...= ....j.:~..|Gy}0. d[50]=3D....*.M.c..'.O....k.....U....#..PQ.7W.&..y._N..z= .? > 1 08:00:52.113364 23.48.209.87.37265 = US 172.16.90.80.https ZZ s[50]=3D..............a.T..5_8..4|.....W..= ..+Q/.8.. ...lz. d[50]=3D....Y...U..[.u..M...__w6LW..H.2...nB..{C... ..S.= .Z > 1 08:00:52.113383 23.48.209.87.37264 = US 172.16.90.80.https ZZ s[50]=3D................Ku.......&B.4.;...= .S..N.?.* ...lz. d[50]=3D....Y...U..[.u........ln..Nf...U....y...Nt| ....= \. > 1 08:00:52.114270 23.48.209.87.37267 = US 172.16.90.80.https ZZ s[50]=3D...........W..J....."G.......Jh.. .= A....~.. ...lz. d[50]=3D....Y...U..[.u......3K...S."L.*..G.....e7 . ..\..= . > 1 08:00:52.114281 23.48.209.87.37271 = US 172.16.90.80.https ZZ s[50]=3D.............:}@MY..Q.tg....AIk...= ..-9$.{.. ...lz. d[50]=3D....Y...U..[.u....e.8.".X.....2Z..4.`..p.i. ....= .@ > 1 08:00:52.114303 23.48.209.87.37268 = US 172.16.90.80.https ZZ s[50]=3D..............09`%x<V/.......^qB2.= .1.....*. ...lz. d[50]=3D....Y...U..[.u.B/.*n0i..$.i..yA9.H.>Pg9.l.X .C~.= .7 >=20 >=20 > Thanks > Monah >=20 >> On Thu, Oct 18, 2018 at 4:28 AM Carter Bullard <[email protected]> wrote= : >> Hey Monah, >> The name is coming from ratop.1 doing a reverse lookup of the address fro= m the DNS server you are configured to use. Turn off name resolution to see= what IP address argus is reporting, then point your system DNS to a server t= hat will give you local names. >>=20 >> Carter >> =09 >> Carter Bullard =E2=80=A2 CTO >> 150 E 57th Street Suite 12D >> New York, New York 10022-2795 >> Phone +1.212.588.9133 =E2=80=A2 Mobile +1.917.497.9494 >>=20 >>> On Oct 17, 2018, at 6:47 PM, Monah Baki <[email protected]> wrote: >>>=20 >>> Hi all, >>>=20 >>> We are using akamai WAF services to protect our webserver. Currently run= ning the latest argus/client on the webserver. When running ratop, the SrcAd= dr shows only the akamai IP (a23-212-3-119.deploy.static.akamaitechn*) hitti= ng our webserver.=20 >>> Akamai confirmed True-Client-IP is enabled and we should be able to see t= he real IP in the request header. Can I get this info when using ratop? >>>=20 >>>=20 >>> Trans StartTime SrcAddr Sport= sCo DstAddr Dport dCo srcUdata = dstUdata >>> 14 12:42:39.209029 a23-212-3-119.deploy.static.akamaitechn*.49057= US www.ntis.gov.https ZZ s[50]=3D............s~V-...Tl....x..`...= <.#.4^.+..a ..+... d[50]=3D....Y...U..[.f...=3D...|.I....:.t..?..:Yc...& O= .-G]. >>> 2 12:45:50.752456 a23-212-53-84.deploy.static.akamaitechn*.61219= US www.ntis.gov.https ZZ s[50]=3D...........g.....E{.K.:S.4..4.e.= F_..^.A."Rx o#Rr&3 d[50]=3D....Q...M..[.g>.....*..... ....G.as.V..y..d o#= Rr&3 >>>=20 >>>=20 >>> Thanks >>> Monah --Apple-Mail-E9BC6DE6-281F-4862-83CB-5D6087DFA797 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable <html><head><meta http-equiv=3D"content-type" content=3D"text/html; charset=3D= utf-8"></head><body dir=3D"auto">Hey Monah,<div>If those are the right IP ad= dresses, then Its up to akamai if those DNS servers will give you the right n= ame.<br><div>Carter<br><div id=3D"AppleMailSignature" dir=3D"ltr"><table id=3D= "sig" width=3D"360" cellspacing=3D"0" cellpadding=3D"0" border-spacing=3D"0"= class=3D"" style=3D"font-family: UICTFontTextStyleBody; -webkit-text-size-a= djust: auto; font-size: 13pt; width: 360px; margin: 0px; padding: 0px;"><tbo= dy class=3D""><tr class=3D""><td width=3D"142" class=3D"" style=3D"width: 14= 2px; margin: 0px; padding: 0px;"><a href=3D"http://qosient.com/" title=3D"Qo= Sient" class=3D"" style=3D"text-decoration: none; border: none; color: rgb(1= 49, 79, 114);"><img src=3D"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAR8= AAABdCAYAAACcsGKeAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAACy9JREFU= eNrsndt140YShmt85n2RgbERCI5gMBEMNgLBEZiOQHAEtCOgHIFGEZCKgNoIyI2AzMArnGkcy5jq= C9DVF4D/dw4eRElEo6vr7+oLqokAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBN= 8CGTctSaz1/frivMlJTi7apGn53VBcBixKdW193bVTKNWsfQ2F/eroO6QDixad+uT8pWheFvX9U1= 2OUs2Ebe2/4RZgFzaN6u3dt1ebv+EryelJMUqGIRSmUnH5scBWzSjb5zD9OAqb1n34hOwoLDXRfl= NCWqXczhJWyynWkTiA/wasiXCKLDXTtEQpM7iWPgjqGB+IAY8zmukc5e9Yyt+r/S8J2NapBPjqLW= /80G5rBSWex1Ujbi7FMpu2wdxKuD+ICQbCPO0dSOc0h7REHGiOdiEJ12xnyRbpgN8QHJwvZQ8zHD= qszJEgVVMNN3HA228mVsE4gPiB627ynOJHBB9gnTFubSOneoOhpEaKr41Op/hgu2y48yZadeGcL2= S6IGU1qiMDTib3XE1c02YMeAyHN9beiSKiI1Cc+R0i957yBAk+rmCH8CM6ZZ9ilufqH8J3hbgwA1= N9x4ONvV8Ckwo/OKLj4hJypjCdCtTkLXxK9sAeA64km2ELA1RDy50hqGh7e2DN9RvLkesP7Oa5/q= xkty4o7iTrLmyhNhDgwsUHxOmuFLuWDH++vGhl97wnwPyEh8fnCMHDiR+ZmWk9OlL+tVM5QEACTA= Jj79kOoX5vOv6loKvfD8qlHzW+798foJyFZ8NpoG+usCn/WR+CRkDzdiay5KxQZAkC3cXM9uwc9T= 0+3O/XSEDYZAzne853w+Gn7Xb8Yrmc9/W3AF9pHPKyM29+rzGFRMNBkjV/WBifIq1agON+5Y3Gsg= ueYPrxdSTiumHM59hNOOPuvnef6z8IbWMtFbPyT5d6D79SL+RTXuykEgXlQ9hxDDCyN8/T0/Z+Zc= 9cg2j8L3KEd20c19XVX9PCubSDl5Z/l53EHcqzqpLOV8UXV1negPpcPf/TjSg94uf07o+CZ1cNyQ= aw2vJhQRhl4l+eetPpL8PpyOZBJ+xRwe7gPYxSddr8Qk/fi7daKzn1nObkI59xQ+w+ik9lVpvmQt= cBW+ERK2TthwJ5JbkTO9m9etXHyk7CKRKdPmV51Qu6lyFp+PBvHhQqe18MI4dH9UzO+eczk7B4Nf= mSFVbemt96psvquM/b37PU9PzO8eVB0saf+Wq+A+OQj4wdEm/ff1+8PulD2k51t2lojXtZylip5/= tgxbXyfUY2Vpxzomtacu89BcYl5BcuWnIXN+o536m8IiXhsy5ySSyhywFQzbc458TJk2hxzVlUX4= N6RPmjf39SJd5LPTlLOzlLNSz6Jrg3UAnwn2esWe1p2KohAcVrYBnLg2hMNS79PZ5j5SiZCU+OiE= 5zKzI201zn0UEp8d+SflKzR2vZBM7vRk4lPTuuAcrvA0iHQK2Y1gg5/iUNzermZh4vOkqTefhYVS= I2hbz7bXCEe4G5LfnxdNfCQcM3eOngJbahxXehOmLnOk1HtpJbmvAA1DgDJz8dkEjBh1k/a1h39d= ArQfTnzLpYrP2vCN7vYUb/d3ReGzEE4RoeFZ6wzFhxMH6QwMNfklZjPVqeTUwkXw+yE+mYgPN8/z= FLi8vg1+igh15L5HSXo/kq/47CjOfCV3n9bDv0I485YRYYjPwsXnxIhAjGFpR3ETgrXkvg/kJFQW= H/EpKF6mzdKjAwoxIexaxgris1zxaSntSuCJ4udhLlUv6nIctu9ku4/4bCjuQgk3r1LM8K8mYnvZ= 5C4+F+HJqhw5zXzGPaV9Mzy1+LlEQz5J+n3E5xhZmOfaImbHPhbILhfx0eXzedX0fmuCe56zw/+M= e9I/Ipf7kSnnl8j3/6yug2H4s6e4qUq4N9NDJ7zjvv9TZu38v7mWTyc+15WLzxzhIU0InyKj41eH= coXmoARIl6K2oHhHZpNG6F4C3/PKtJvcckOdc3XCHxzVsuduReJTzTTSHeOAKXKpPDNimmofVh8J= /aSJlocdtzGoHedkpK+SeWaIj/Cwq16R+Hya2UtWkXtWU9ThIqgxG/hnQ7tpI5ThXxl3bGCC+Oga= 91p2OTeOz2wbrqXMIHfNbFh8VQLE1ckDnB6M+WhoSFy60Ybks8ql6Jk4EZkjPq8Jn+N1FI2WGdTt= cErIjqm3KnJ99e30T7j48sSHlOG4XMdLF5975rOvaAqiTv/AiGETWXz+R8hNvchhl84h64WHt4Vm= /uEZTUGUJSxBg4zF56zpOX5Z8PNy55CdEfmI8+wwZAUQHyPcMTktLXPlS3f66pRNgufRzymjwMpS= tpSk2KQ6Xnn8Ee69bPE5aKKfJZ5xzp080E+QPnqIT6oGXmgiuFzI4RwpRFoLFx9d9NP3ut2CnrMh= fnn9t4mOMiXxe0hqx2jjljhkYhsgKD69Ubk5kQdaxuTzcKoE56xTT6t4Yb47RQ/7hXmWnE6tTLEf= 7FXT6YAFi0+P7v2dPeW98bAg/UFvc46hOWTSwBuHcqUWfIpcRm6v1j1cfPniM5z3xDl3rgJkerP6= 95nOcGWiwNirfy1T37ltpuOGPOcI931mRLqEm68DXY5fqeTcksJzNJTV17FSnWnWP9eJ0uYTcoHL= ldQ6/m9HfpkMLxQp6ZUHMfP51EL1UedQryanzqGXKQ1llEokvie55FlT2JJfGtUYZWzJL01oR/I5= nDcQn3WIT2Fx7jpxuG86ObQKZNAY0R/n1FMbwCWwIxaaqGdKWg1f8dEdbRNDeCvH+6xBfE6pnNwk= QCmOVi7IfgSwdOPbRhSgRuiZpA81tEWEc6LNjsKc2xU6Ot1M6HzXID5J87rbBOgUKQpqyZzYPFSj= 0z2/tAC1mudqZ3wX10lIHaS3E+qIOiFn0Qmh9OpkObrXLYlPmVqAbNni9hRmOdomOhLH47o0vEug= 4acpmpubHTDEmeymObY5DV1KfEyd41ZAdAvizzdbq/gUFPfYptkNRhcJbT2dslGO53KgnUQDcx3n= XwzOV88wcmv4Tp+0pLYTJ7YTxLq0DHXnRoBS4mPqHN6fM1bMsPfW8L1rFR8ifqW1cLRDRwHnGyvL= MIxzzK0qVKMq6f3VqN/tyP3guqFC6sjia3v2QXgbjXPXyhFswrqNZKOTKks3skmrPjs62GCu8EuK= jy0yG0R3R/oXpoe26HJumatzLVV8OtKfWFsy992MRkZdaEd0GQ6FuKROzAw5BJ17Sc9VtOR+HPLU= a+cZcUqLT2jbDGWcMrxfqvjY5nltVxfLGVvPgrpeT5TXOzy1sPj6OrOpIW0Ey3oSskMI8Xk/bJe0= zXHmMy9VfGzTDNmIz3iMfBIWnA3lvXW+nThc5IYCsZ6v8YgMTsQnactRfCQ6xsE2PkP7JYvPnEjy= RMyixofIDlnS3xuxPhF/yuSY/m3lM307S+xAy8vLWyjnvnv37AXzjP17Yy8ZPGNjsc97e3wl+VQe= 5Uh0rxQuXUj5zjalRlAOqgyS7a9m7hGy/VWB6rP/3nv6Pr3yWV0vgdqIKNtIcx0AAMD2uKYl6xJV= BAAIOSwzjcVj7d0BANwoHZkn/DqIEAAgZBRkWy3qVx18Xp9oIGIAAJNA2Jbph6W8Ka8GDC9Cdqhi= AOLzYUFlbYk/hnfMsJT4Qt8vKw5LyMMKWv+7z5RX8nUAQMYiJLFzekp2PQAA+EcU4/qGe+zEUgCA= G2FIteH6CkeLKgMAhIiINkqMuOFZhyoCID0fbuQ5a/o2v1PS9FNKAQAAAAAAAAAAAAAAAAAAAAAA= AAAASM3/BRgAaVGndQa4eeAAAAAASUVORK5CYII=3D" alt=3D"QoSient" class=3D"" style= =3D"border: none; height: 48px; line-height: 48px; font-size: 48px; font-fam= ily: 'Gill Sans', sans-serif; color: rgb(0, 0, 0);"></a></td><td width=3D"20= " class=3D"" style=3D"width: 16px; min-width: 16px; max-width: 16px; margin:= 0px; padding: 0px;"> </td><td class=3D"" style=3D"margin: 0px; padding= : 0px; border-collapse: collapse;"><table id=3D"sig2" cellspacing=3D"0" cell= padding=3D"0" border-spacing=3D"0" class=3D""><tbody class=3D""><tr class=3D= ""><td class=3D"" style=3D"white-space: nowrap; font-family: 'Gill Sans Ligh= t', sans-serif;"><a href=3D"mailto:[email protected]" class=3D"" style=3D"t= ext-decoration: none; border: none; color: rgb(149, 79, 114);"><span class=3D= "" style=3D"line-height: 16px; font-size: 16px; color: rgb(0, 0, 176);">Cart= er Bullard</span> </a><span class=3D"" style=3D"line-height: 14px; font= -size: 12px;">=E2=80=A2</span> <span class=3D"" style=3D"line-height: 1= 4px; font-size: 12px;">CTO</span></td></tr><tr class=3D""><td class=3D"" sty= le=3D"white-space: nowrap; font-family: 'Gill Sans Light', sans-serif;"><spa= n class=3D"" style=3D"line-height: 14px; font-size: 12px;">150 E 57th Street= Suite 12D</span></td></tr><tr class=3D""><td class=3D"" style=3D"white= -space: nowrap; font-family: 'Gill Sans Light', sans-serif;"><span class=3D"= " style=3D"line-height: 14px; font-size: 12px;">New York, New York 10022-279= 5</span></td></tr><tr class=3D""><td class=3D"" style=3D"white-space: nowrap= ; font-family: 'Gill Sans Light', sans-serif;"><span class=3D"" style=3D"lin= e-height: 12px; font-size: 12px;">Phone +1.212.588.9133 =E2=80=A2 Mobil= e +1.917.497.9494<br></span></td></tr></tbody></table></td></tr></tbody></ta= ble></div><div dir=3D"ltr"><br>On Oct 18, 2018, at 2:04 PM, Monah Baki <<= a href=3D"mailto:[email protected]">[email protected]</a>> wrote:<br>= <br></div><blockquote type=3D"cite"><div dir=3D"ltr"><div dir=3D"ltr"><div d= ir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr">Morning Carter= <div><br></div><div>My /etc/resolv.conf has the following local dns server</= div><div><div>nameserver 172.16.64.44<br></div><div>nameserver 172.16.84.45<= /div></div><div><br></div><div>If I turn of name resolution in ratop I get t= he following (23.x.x.x) is akamai:</div><div><br></div><div><div> &nbs= p; 2 07:59:22.790847 &n= bsp; 23.212.3.= 119.33852 US 172.16.90.80.https &= nbsp;ZZ s[50]=3D..................{....../............1.I.. ..c.i. &nb= sp; d[50]=3D....Y...U..[.u...\>...Q..7Z....[.v.=3D.....D. !.....</div></d= iv><div><div> 9 07:58:10.105559 =  = ; 23.212.3.111.40000 US 1= 72.16.90.80.https ZZ s[50]=3D.....=3D^.....y... .rC....%|.`k..l.= ..~.Lw.Gv/}.irH._ d[50]=3D....+knR.?~..`c..............;.. ...$= ..]f.#.......</div><div> 9 07:58:10.098356&n= bsp; &= nbsp; 23.212.3.119.61694 US &nb= sp; 172.16.90.80.https ZZ s[50]=3D.......jk.....J&pfg.= ..f.5..F.L1.\....m.....$..R..k d[50]=3D....*.,.Q......6..w....|= .8....Ll..'......du...sF..</div><div> 9 07:5= 8:10.107991 &n= bsp; 23.212.3.111.40003 US&nbs= p; 172.16.90.80.https ZZ s[50]=3D.....%..."+= K....w].g^....Y.q..;.......j.:~..|Gy}0. d[50]=3D....*.M.c..'.O.= ...k.....U....#..PQ.7W.&..y._N..z.?</div><div> 1 = ; 08:00:52.113364 &nb= sp; 23.48.209.87.37265 = US 172.16.90.80.https ZZ s[50]=3D= ..............a.T..5_8..4|.....W....+Q/.8.. ...lz. d[50]=3D....= Y...U..[.u..M...__w6LW..H.2...nB..{C... ..S..Z</div></div><div><div> &= nbsp; 1 08:00:52.113383 = 23.48.= 209.87.37264 US 172.16.90.80.https&nbs= p; ZZ s[50]=3D................Ku.......&B.4.;....S..N.?.* ...lz.&n= bsp; d[50]=3D....Y...U..[.u........ln..Nf...U....y...Nt| ....\.</div>= <div> 1 08:00:52.114270 &= nbsp; &= nbsp;23.48.209.87.37267 US 172.16.90.8= 0.https ZZ s[50]=3D...........W..J....."G.......Jh.. .A....~.. .= ..lz. d[50]=3D....Y...U..[.u......3K...S."L.*..G.....e7 . ..\..= .</div><div> 1 08:00:52.114281 &= nbsp; &= nbsp; 23.48.209.87.37271 US 172.= 16.90.80.https ZZ s[50]=3D.............:}@MY..Q.tg....AIk.....-9= $.{.. ...lz. d[50]=3D....Y...U..[.u....e.8.".X.....2Z..4.`..p.i= . .....@</div><div> 1 08:00:52.114303 &= nbsp; &= nbsp; 23.48.209.87.37268 US &nb= sp;172.16.90.80.https ZZ s[50]=3D..............09`%x<V/......= .^qB2..1.....*. ...lz. d[50]=3D....Y...U..[.u.B/.*n0i..$.i..yA9= .H.>Pg9.l.X .C~..7</div><div><br></div></div><div><br></div><div>Thanks</= div><div>Monah</div></div></div></div></div></div><br><div class=3D"gmail_qu= ote"><div dir=3D"ltr">On Thu, Oct 18, 2018 at 4:28 AM Carter Bullard <<a h= ref=3D"mailto:[email protected]">[email protected]</a>> wrote:<br></div= ><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p= x #ccc solid;padding-left:1ex"><div dir=3D"auto">Hey Monah,<div>The name is c= oming from ratop.1 doing a reverse lookup of the address from the DNS server= you are configured to use. Turn off name resolution to see what IP ad= dress argus is reporting, then point your system DNS to a server that will g= ive you local names.</div><div><br>Carter<br><div id=3D"m_-58765598182228160= 43AppleMailSignature" dir=3D"ltr"><table id=3D"m_-5876559818222816043sig" wi= dth=3D"360" cellspacing=3D"0" cellpadding=3D"0" style=3D"font-family:UICTFon= tTextStyleBody;font-size:13pt;width:360px;margin:0px;padding:0px"><tbody><tr= ><td width=3D"142" style=3D"width:142px;margin:0px;padding:0px"><a href=3D"h= ttp://qosient.com/" title=3D"QoSient" style=3D"text-decoration:none;border:n= one;color:rgb(149,79,114)" target=3D"_blank"><img alt=3D"QoSient" style=3D"b= order:none;height:48px;line-height:48px;font-size:48px;font-family:'Gill San= s',sans-serif;color:rgb(0,0,0)" src=3D"cid:"></a></td><td width=3D"20" style= =3D"width:16px;min-width:16px;max-width:16px;margin:0px;padding:0px"> <= /td><td style=3D"margin:0px;padding:0px;border-collapse:collapse"><table id=3D= "m_-5876559818222816043sig2" cellspacing=3D"0" cellpadding=3D"0"><tbody><tr>= <td style=3D"white-space:nowrap;font-family:'Gill Sans Light',sans-serif"><a= href=3D"mailto:[email protected]" style=3D"text-decoration:none;border:non= e;color:rgb(149,79,114)" target=3D"_blank"><span style=3D"line-height:16px;f= ont-size:16px;color:rgb(0,0,176)">Carter Bullard</span> </a><span style= =3D"line-height:14px;font-size:12px">=E2=80=A2</span> <span style=3D"li= ne-height:14px;font-size:12px">CTO</span></td></tr><tr><td style=3D"white-sp= ace:nowrap;font-family:'Gill Sans Light',sans-serif"><span style=3D"line-hei= ght:14px;font-size:12px">150 E 57th Street Suite 12D</span></td></tr><t= r><td style=3D"white-space:nowrap;font-family:'Gill Sans Light',sans-serif">= <span style=3D"line-height:14px;font-size:12px">New York, New York 10022-279= 5</span></td></tr><tr><td style=3D"white-space:nowrap;font-family:'Gill Sans= Light',sans-serif"><span style=3D"line-height:12px;font-size:12px">Phone +1= .212.588.9133 =E2=80=A2 Mobile +1.917.497.9494<br></span></td></tr></tb= ody></table></td></tr></tbody></table></div><div dir=3D"ltr"><br>On Oct 17, 2= 018, at 6:47 PM, Monah Baki <<a href=3D"mailto:[email protected]" targe= t=3D"_blank">[email protected]</a>> wrote:<br><br></div><blockquote typ= e=3D"cite"><div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"lt= r">Hi all,<div><br></div><div>We are using akamai WAF services to protect ou= r webserver. Currently running the latest argus/client on the webserver. Whe= n running ratop, the SrcAddr shows only the akamai IP (a23-212-3-119.deploy.= static.akamaitechn*) hitting our webserver. </div><div>Akamai confirmed= True-Client-IP is enabled and we should be able to see the real IP in the r= equest header. Can I get this info when using ratop?</div><div><br></div><di= v><br></div><div><div>Trans StartTime = ; &nbs= p; SrcAddr Sport sCo &= nbsp; DstAddr Dport dCo  = ; srcUdata&nb= sp; &n= bsp; &= nbsp; dstUdata</div><div> 14 1= 2:42:39.209029 a23-212-3-119.deploy.static.akamaitechn*.49057 US= <a href=3D"http://www.ntis.gov.https" target=3D"_= blank">www.ntis.gov.https</a> ZZ s[50]=3D............s~V-...Tl..= ..x..`...<.#.4^.+..a ..+... d[50]=3D....Y...U..[.f...=3D...|= .I....:.t..?..:Yc...& O.-G].<br></div><div> 2 &= nbsp; 12:45:50.752456 a23-212-53-84.deploy.static.akamaitechn*.61219 &= nbsp;US <a href=3D"http://www.ntis.gov.https" targ= et=3D"_blank">www.ntis.gov.https</a> ZZ s[50]=3D...........g....= .E{.K.:S.4..4.e.F_..^.A."Rx o#Rr&3 d[50]=3D....Q...M..[.g&g= t;.....*..... ....G.as.V..y..d o#Rr&3</div></div><div><br></div><div><br= ></div><div>Thanks</div><div>Monah</div></div></div></div> </div></blockquote></div></div></blockquote></div> </div></blockquote></div></div></body></html>= --Apple-Mail-E9BC6DE6-281F-4862-83CB-5D6087DFA797--