Re: Akamai WAF

On October 17, 2018 12:47:43 PM EDT, Monah Baki <monahbaki@gmail=2Ecom> wro=
te:
>Hi all,
>
>We are using akamai WAF services to protect our webserver=2E Currently
>running the latest argus/client on the webserver=2E When running ratop,
>the
>SrcAddr shows only the akamai IP
>(a23-212-3-119=2Edeploy=2Estatic=2Eakamaitechn*)
>hitting our webserver=2E
>Akamai confirmed True-Client-IP is enabled and we should be able to see
>the
>real IP in the request header=2E Can I get this info when using ratop?
>
>
>Trans          StartTime                                  SrcAddr=20
>Sport
>sCo            DstAddr  Dport dCo                          srcUdata
>                                            dstUdata
>   14    12:42:39=2E209029 a23-212-3-119=2Edeploy=2Estatic=2Eakamaitechn*=
=2E49057
> US       www=2Entis=2Egov=2Ehttps   ZZ
>s[50]=3D=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2Es~V-=2E=2E=2ETl=2E=2E=2E=2Ex=
=2E=2E`=2E=2E=2E<=2E#=2E4^=2E+=2E=2Ea =2E=2E+=2E=2E=2E
>d[50]=3D=2E=2E=2E=2EY=2E=2E=2EU=2E=2E[=2Ef=2E=2E=2E=3D=2E=2E=2E|=2EI=2E=
=2E=2E=2E:=2Et=2E=2E?=2E=2E:Yc=2E=2E=2E& O=2E-G]=2E
>    2    12:45:50=2E752456 a23-212-53-84=2Edeploy=2Estatic=2Eakamaitechn*=
=2E61219
> US       www=2Entis=2Egov=2Ehttps   ZZ
>s[50]=3D=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2Eg=2E=2E=2E=2E=2EE{=2EK=2E:S=2E4=
=2E=2E4=2Ee=2EF_=2E=2E^=2EA=2E"Rx o#Rr&3
>d[50]=3D=2E=2E=2E=2EQ=2E=2E=2EM=2E=2E[=2Eg>=2E=2E=2E=2E=2E*=2E=2E=2E=2E=
=2E =2E=2E=2E=2EG=2Eas=2EV=2E=2Ey=2E=2Ed o#Rr&3
>
>
>Thanks
>Monah

Since this value is in the http headers and, in this case, https is used y=
ou will not be able to see the address in the Argus user buffers=2E  For no=
n-encrypted http, set the ARGUS_CAPTURE_DATA_LEN to something large enough =
to get all of the http headers and then the duser column in ratop should sh=
ow what you want=2E