3 Replies Latest reply on Oct 4, 2011 10:58 AM by gsr_privado

    URL.DestinationIP property

      Hi,

       

      I have this request http. but I need to know what value takes URL.DestinatioIP property for this request.

       

      Ipaddress 200.0.156.42 or localhost?

       

       

       

       

      No.     Time        Source                Destination           Protocol Length Info                                                            Destination Port

          355 6.603447    172.21.23.62          200.0.156.42          HTTP     348    POST /cgi-bin/autentia3-tran.fcgi HTTP/1.1  (text/plain)        http

       

      Frame 355: 348 bytes on wire (2784 bits), 348 bytes captured (2784 bits)

          Arrival Time: Sep 30, 2011 03:18:16.744702000 Hora verano Sudamérica PacÃfico

          Epoch Time: 1317363496.744702000 seconds

          [Time delta from previous captured frame: 0.001432000 seconds]

          [Time delta from previous displayed frame: 0.001876000 seconds]

          [Time since reference or first frame: 6.603447000 seconds]

          Frame Number: 355

          Frame Length: 348 bytes (2784 bits)

          Capture Length: 348 bytes (2784 bits)

          [Frame is marked: False]

          [Frame is ignored: False]

          [Protocols in frame: eth:ip:tcp:http:data-text-lines]

          [Coloring Rule Name: HTTP]

          [Coloring Rule String: http || tcp.port == 80]

      Ethernet II, Src: HewlettP_0d:a7:9a (00:16:35:0d:a7:9a), Dst: Cisco_b2:20:cd (08:17:35:b2:20:cd)

          Destination: Cisco_b2:20:cd (08:17:35:b2:20:cd)

              Address: Cisco_b2:20:cd (08:17:35:b2:20:cd)

              .... ...0 .... .... .... .... = IG bit: Individual address (unicast)

              .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)

          Source: HewlettP_0d:a7:9a (00:16:35:0d:a7:9a)

              Address: HewlettP_0d:a7:9a (00:16:35:0d:a7:9a)

              .... ...0 .... .... .... .... = IG bit: Individual address (unicast)

              .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)

          Type: IP (0x0800)

      Internet Protocol Version 4, Src: 172.21.23.62 (172.21.23.62), Dst: 200.0.156.42 (200.0.156.42)

          Version: 4

          Header length: 20 bytes

          Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))

              0000 00.. = Differentiated Services Codepoint: Default (0x00)

              .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)

          Total Length: 334

          Identification: 0x6b4f (27471)

          Flags: 0x02 (Don't Fragment)

              0... .... = Reserved bit: Not set

              .1.. .... = Don't fragment: Set

              ..0. .... = More fragments: Not set

          Fragment offset: 0

          Time to live: 128

          Protocol: TCP (6)

          Header checksum: 0x66dc [correct]

              [Good: True]

              [Bad: False]

          Source: 172.21.23.62 (172.21.23.62)

          Destination: 200.0.156.42 (200.0.156.42)

      Transmission Control Protocol, Src Port: unicontrol (2499), Dst Port: http (80), Seq: 1, Ack: 1, Len: 294

          Source port: unicontrol (2499)

          Destination port: http (80)

          [Stream index: 12]

          Sequence number: 1    (relative sequence number)

          [Next sequence number: 295    (relative sequence number)]

          Acknowledgement number: 1    (relative ack number)

          Header length: 20 bytes

          Flags: 0x18 (PSH, ACK)

              000. .... .... = Reserved: Not set

              ...0 .... .... = Nonce: Not set

              .... 0... .... = Congestion Window Reduced (CWR): Not set

              .... .0.. .... = ECN-Echo: Not set

              .... ..0. .... = Urgent: Not set

              .... ...1 .... = Acknowledgement: Set

              .... .... 1... = Push: Set

              .... .... .0.. = Reset: Not set

              .... .... ..0. = Syn: Not set

              .... .... ...0 = Fin: Not set

          Window size value: 65535

          [Calculated window size: 65535]

          [Window size scaling factor: -2 (no window scaling used)]

          Checksum: 0x99ab [validation disabled]

              [Good Checksum: False]

              [Bad Checksum: False]

          [SEQ/ACK analysis]

              [Bytes in flight: 294]

      Hypertext Transfer Protocol

          POST /cgi-bin/autentia3-tran.fcgi HTTP/1.1\n

              [Expert Info (Chat/Sequence): POST /cgi-bin/autentia3-tran.fcgi HTTP/1.1\n]

                  [Message: POST /cgi-bin/autentia3-tran.fcgi HTTP/1.1\n]

                  [Severity level: Chat]

                  [Group: Sequence]

              Request Method: POST

              Request URI: /cgi-bin/autentia3-tran.fcgi

              Request Version: HTTP/1.1

          Host: localhost\r\n

          Content-Type: text/plain; charset=utf-8\r\n

          Date: Fri Sep 30 03:18:16 2011\r\n

          CONTENT-LENGTH:       132\r\n

              [Content length: 132]

          \r\n

          [Full request URI: http://localhost/cgi-bin/autentia3-tran.fcgi]

      Line-based text data: text/plain

          *\235=IØ\206H¯=`dg&:Ö\016䢸)õ\032RU\037·}<S·Î¶\201AJ3Ã\037}\231ÔJã\025º\227Ì}Ç ÍD{\217zP¶y½ßrùÊ=`N\025whe\006Ýï\021O,ða\020ÂÞ07Y\032\233Ewq\034?\224ãK\201\216\ 217ÚÅÀÑÍzIY}\210\225ò×+C\026(\203ÆW=@Ó\221Á©ð\022_\036\205\005)\212õF

        • 1. Re: URL.DestinationIP property
          ITWebSec

          Your client is erroneously defining the Host: header as localhost. This is illegal from an HTTP protocol perspective.

          The URL.Desitnation.IP address will always return 127.0.0.1 and not the actual TCP connection's IP address, therefore it cannot be used as a property.

           

          Because the request is actually illegal, MWG will not pass it no matter what. I dare support to prove me wrong.

           

          If you were using explicit proxy, you could bypass it.

          If you were using WCCP, you could setup an ACL to prevent requests from going to the proxy entirely.

          Since you are using bridge mode, there is nothing you can do.

           

          Bridge mode is never a good idea, ever (for any product i've ever managed)

           

          Message was edited by: ITWebSec on 9/30/11 5:44:08 PM CDT
          • 2. Re: URL.DestinationIP property
            asabban

            Hello,

             

            when you use WCCP you can have a look at Configuration -> Proxies. There is a checkbox that says: "HTTP(S): Host header has priority over original destination address". This checkbox should help you to define if you want to use the destination IP or Host header as a preference.

             

            Best,

            Andre

            • 3. Re: URL.DestinationIP property

              Hi,

              I defined the 127.0.0.1 in the Bypass request and works fine,

               

              thanks