URL.DestinationIP property

[gsr_privado]

Hi,

I have this request http. but I need to know what value takes URL.DestinatioIP property for this request.

Ipaddress 200.0.156.42 or localhost?

No.     Time        Source                Destination           Protocol Length Info                                                            Destination Port

    355 6.603447    172.21.23.62          200.0.156.42          HTTP     348    POST /cgi-bin/autentia3-tran.fcgi HTTP/1.1  (text/plain)        http

Frame 355: 348 bytes on wire (2784 bits), 348 bytes captured (2784 bits)

    Arrival Time: Sep 30, 2011 03:18:16.744702000 Hora verano Sudamérica Pacífico

    Epoch Time: 1317363496.744702000 seconds

    [Time delta from previous captured frame: 0.001432000 seconds]

    [Time delta from previous displayed frame: 0.001876000 seconds]

    [Time since reference or first frame: 6.603447000 seconds]

    Frame Number: 355

    Frame Length: 348 bytes (2784 bits)

    Capture Length: 348 bytes (2784 bits)

    [Frame is marked: False]

    [Frame is ignored: False]

    [Protocols in frame: eth:ip:tcp:http:data-text-lines]

    [Coloring Rule Name: HTTP]

    [Coloring Rule String: http || tcp.port == 80]

Ethernet II, Src: HewlettP_0d:a7:9a (00:16:35:0d:a7:9a), Dst: Cisco_b2:20:cd (08:17:35:b2:20:cd)

    Destination: Cisco_b2:20:cd (08:17:35:b2:20:cd)

        Address: Cisco_b2:20:cd (08:17:35:b2:20:cd)

        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)

        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)

    Source: HewlettP_0d:a7:9a (00:16:35:0d:a7:9a)

        Address: HewlettP_0d:a7:9a (00:16:35:0d:a7:9a)

        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)

        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)

    Type: IP (0x0800)

Internet Protocol Version 4, Src: 172.21.23.62 (172.21.23.62), Dst: 200.0.156.42 (200.0.156.42)

    Version: 4

    Header length: 20 bytes

    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))

        0000 00.. = Differentiated Services Codepoint: Default (0x00)

        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)

    Total Length: 334

    Identification: 0x6b4f (27471)

    Flags: 0x02 (Don't Fragment)

        0... .... = Reserved bit: Not set

        .1.. .... = Don't fragment: Set

        ..0. .... = More fragments: Not set

    Fragment offset: 0

    Time to live: 128

    Protocol: TCP (6)

    Header checksum: 0x66dc [correct]

        [Good: True]

        [Bad: False]

    Source: 172.21.23.62 (172.21.23.62)

    Destination: 200.0.156.42 (200.0.156.42)

Transmission Control Protocol, Src Port: unicontrol (2499), Dst Port: http (80), Seq: 1, Ack: 1, Len: 294

    Source port: unicontrol (2499)

    Destination port: http (80)

    [Stream index: 12]

    Sequence number: 1    (relative sequence number)

    [Next sequence number: 295    (relative sequence number)]

    Acknowledgement number: 1    (relative ack number)

    Header length: 20 bytes

    Flags: 0x18 (PSH, ACK)

        000. .... .... = Reserved: Not set

        ...0 .... .... = Nonce: Not set

        .... 0... .... = Congestion Window Reduced (CWR): Not set

        .... .0.. .... = ECN-Echo: Not set

        .... ..0. .... = Urgent: Not set

        .... ...1 .... = Acknowledgement: Set

        .... .... 1... = Push: Set

        .... .... .0.. = Reset: Not set

        .... .... ..0. = Syn: Not set

        .... .... ...0 = Fin: Not set

    Window size value: 65535

    [Calculated window size: 65535]

    [Window size scaling factor: -2 (no window scaling used)]

    Checksum: 0x99ab [validation disabled]

        [Good Checksum: False]

        [Bad Checksum: False]

    [SEQ/ACK analysis]

        [Bytes in flight: 294]

Hypertext Transfer Protocol

    POST /cgi-bin/autentia3-tran.fcgi HTTP/1.1\n

        [Expert Info (Chat/Sequence): POST /cgi-bin/autentia3-tran.fcgi HTTP/1.1\n]

            [Message: POST /cgi-bin/autentia3-tran.fcgi HTTP/1.1\n]

            [Severity level: Chat]

            [Group: Sequence]

        Request Method: POST

        Request URI: /cgi-bin/autentia3-tran.fcgi

        Request Version: HTTP/1.1

    Host: localhost\r\n

    Content-Type: text/plain; charset=utf-8\r\n

    Date: Fri Sep 30 03:18:16 2011\r\n

    CONTENT-LENGTH:       132\r\n

        [Content length: 132]

    \r\n

    [Full request URI: http://localhost/cgi-bin/autentia3-tran.fcgi]

Line-based text data: text/plain

    *\235=IØ\206H¯=`dg&:Ö\016䢸)õ\032RU\037·}<S·Î¶\201AJ3Ã\037}\231ÔJã\025º\227Ì}ÇÍD{\217zP¶y½ßrùÊ=`N\025whe\006Ýï\021O,ða\020ÂÞ07Y\032\233Ewq\034?\224ãK\201\216\217ÚÅÀÑÍzIY}\210\225ò×+C\026(\203ÆW=@Ó\221Á©ð\022_\036\205\005)\212õF

[ITWebSec]

Your client is erroneously defining the Host: header as localhost. This is illegal from an HTTP protocol perspective.

The URL.Desitnation.IP address will always return 127.0.0.1 and not the actual TCP connection's IP address, therefore it cannot be used as a property.

Because the request is actually illegal, MWG will not pass it no matter what. I dare support to prove me wrong.

If you were using explicit proxy, you could bypass it.

If you were using WCCP, you could setup an ACL to prevent requests from going to the proxy entirely.

Since you are using bridge mode, there is nothing you can do.

Bridge mode is never a good idea, ever (for any product i've ever managed)

Message was edited by: ITWebSec on 9/30/11 5:44:08 PM CDT

[asabban2]

Hello,

when you use WCCP you can have a look at Configuration -> Proxies. There is a checkbox that says: "HTTP(S): Host header has priority over original destination address". This checkbox should help you to define if you want to use the destination IP or Host header as a preference.

Best,

Andre

[gsr_privado · Accepted solution]

Hi,

I defined the 127.0.0.1 in the Bypass request and works fine,

thanks