Re: Akamai WAF

--000000000000a6d21205788079e4
Content-Type: text/plain; charset="UTF-8"

Hi Eric,

I bumped the ARGUS_CAPTURE_DATA_LEN value to 2048, so running ratop -S
localhost:561 -s trans stime saddr:40 sport sco daddr dport dco suser
duser:2048, I can't see the rest of the duser column, gets chopped off,
probably displays 50 characters only (small monitor). Is there a way to
overcome this?

Thanks
Monah

On Thu, Oct 18, 2018 at 8:47 AM Eric Kinzie <[email protected]> wrote:

> On October 17, 2018 12:47:43 PM EDT, Monah Baki <[email protected]>
> wrote:
> >Hi all,
> >
> >We are using akamai WAF services to protect our webserver. Currently
> >running the latest argus/client on the webserver. When running ratop,
> >the
> >SrcAddr shows only the akamai IP
> >(a23-212-3-119.deploy.static.akamaitechn*)
> >hitting our webserver.
> >Akamai confirmed True-Client-IP is enabled and we should be able to see
> >the
> >real IP in the request header. Can I get this info when using ratop?
> >
> >
> >Trans          StartTime                                  SrcAddr
> >Sport
> >sCo            DstAddr  Dport dCo                          srcUdata
> >                                            dstUdata
> >   14    12:42:39.209029 a23-212-3-119.deploy.static.akamaitechn*.49057
> > US       www.ntis.gov.https   ZZ
> >s[50]=............s~V-...Tl....x..`...<.#.4^.+..a ..+...
> >d[50]=....Y...U..[.f...=...|.I....:.t..?..:Yc...& O.-G].
> >    2    12:45:50.752456 a23-212-53-84.deploy.static.akamaitechn*.61219
> > US       www.ntis.gov.https   ZZ
> >s[50]=...........g.....E{.K.:S.4..4.e.F_..^.A."Rx o#Rr&3
> >d[50]=....Q...M..[.g>.....*..... ....G.as.V..y..d o#Rr&3
> >
> >
> >Thanks
> >Monah
>
> Since this value is in the http headers and, in this case, https is used
> you will not be able to see the address in the Argus user buffers.  For
> non-encrypted http, set the ARGUS_CAPTURE_DATA_LEN to something large
> enough to get all of the http headers and then the duser column in ratop
> should show what you want.
>

--000000000000a6d21205788079e4
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">Hi Eric,=C2=A0<div><br></div><div>I bumpe=
d the ARGUS_CAPTURE_DATA_LEN value to 2048, so running=C2=A0ratop -S localh=
ost:561 -s trans stime saddr:40 sport sco daddr dport dco suser duser:2048,=
 I can&#39;t see the rest of the duser column, gets chopped off, probably d=
isplays 50 characters only (small monitor). Is there a way to overcome this=
?</div><div><br></div><div>Thanks</div><div>Monah</div></div></div><br><div=
 class=3D"gmail_quote"><div dir=3D"ltr">On Thu, Oct 18, 2018 at 8:47 AM Eri=
c Kinzie &lt;<a href=3D"mailto:[email protected]">[email protected]</a>&gt; w=
rote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex=
;border-left:1px #ccc solid;padding-left:1ex">On October 17, 2018 12:47:43 =
PM EDT, Monah Baki &lt;<a href=3D"mailto:[email protected]" target=3D"_bl=
ank">[email protected]</a>&gt; wrote:<br>
&gt;Hi all,<br>
&gt;<br>
&gt;We are using akamai WAF services to protect our webserver. Currently<br=
>
&gt;running the latest argus/client on the webserver. When running ratop,<b=
r>
&gt;the<br>
&gt;SrcAddr shows only the akamai IP<br>
&gt;(a23-212-3-119.deploy.static.akamaitechn*)<br>
&gt;hitting our webserver.<br>
&gt;Akamai confirmed True-Client-IP is enabled and we should be able to see=
<br>
&gt;the<br>
&gt;real IP in the request header. Can I get this info when using ratop?<br=
>
&gt;<br>
&gt;<br>
&gt;Trans=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 StartTime=C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 SrcAddr <br>
&gt;Sport<br>
&gt;sCo=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 DstAddr=C2=A0 Dport dCo=C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 srcUdata<br>
&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 dstUdata<br>
&gt;=C2=A0 =C2=A014=C2=A0 =C2=A0 12:42:39.209029 a23-212-3-119.deploy.stati=
c.akamaitechn*.49057<br>
&gt; US=C2=A0 =C2=A0 =C2=A0 =C2=A0www.ntis.gov.https=C2=A0 =C2=A0ZZ<br>
&gt;s[50]=3D............s~V-...Tl....x..`...&lt;.#.4^.+..a ..+...<br>
&gt;d[50]=3D....Y...U..[.f...=3D...|.I....:.t..?..:Yc...&amp; O.-G].<br>
&gt;=C2=A0 =C2=A0 2=C2=A0 =C2=A0 12:45:50.752456 a23-212-53-84.deploy.stati=
c.akamaitechn*.61219<br>
&gt; US=C2=A0 =C2=A0 =C2=A0 =C2=A0www.ntis.gov.https=C2=A0 =C2=A0ZZ<br>
&gt;s[50]=3D...........g.....E{.K.:S.4..4.e.F_..^.A.&quot;Rx o#Rr&amp;3<br>
&gt;d[50]=3D....Q...M..[.g&gt;.....*..... ....G.as.V..y..d o#Rr&amp;3<br>
&gt;<br>
&gt;<br>
&gt;Thanks<br>
&gt;Monah<br>
<br>
Since this value is in the http headers and, in this case, https is used yo=
u will not be able to see the address in the Argus user buffers.=C2=A0 For =
non-encrypted http, set the ARGUS_CAPTURE_DATA_LEN to something large enoug=
h to get all of the http headers and then the duser column in ratop should =
show what you want.<br>
</blockquote></div>

--000000000000a6d21205788079e4--