topic Re: reverse source and destination ip address URL traffic logs with http-proxy application in General Topics

reverse source and destination ip address URL traffic logs with http-proxy application

KunalChopra — Mon, 14 Oct 2019 10:28:36 GMT

Hi Team,

I have a query for URL filtering logs under monitor. i noticed logs specifically for http-proxy app and there i saw source address is public and destination address is private . I wonder how is this possible ?? NOTE :- This was observed while box is in tap mode for SLR .. I am attaching screenshot along

Re: reverse source and destination ip address URL traffic logs with http-proxy application

S.Cantwell — Wed, 30 Oct 2019 22:16:28 GMT

Hello

Looks to me like the public IP server was attempting to talk with a NAT'd public IP address,and the NAT was already performed on it.

You should modify your column to see if there is a Source NAT and Destination NAT field to see/confirm that the private IP inside your network has a public IP.

Glad to help.