I am using squid as proxy in a small setup having one internal NIC and one external NIC. Now using tcp, I can capture traffic on either side but there is some problem that I am facing. If I capture traffic of external NIC then it gave only external NIC IP as client IP and if I capture traffic from internal then destination IP is always SQUID internal IP. What I want is actual client and server IP. How I can do it?

My OS is CentOS 7.2


Unless you're using a transparent proxy, the behaviour you're seeing is normal:

  • clients connect to the proxy to retrieve content, so you see packets from the clients to the proxy and back;
  • the proxy connects to the target servers on behalf of the clients, so you see packets from the proxy to the target servers and back.

At the IP level, there is no way of connecting the two. If your proxy is a caching proxy, then in some cases there won't be anything to connect: the proxy can service clients' requests itself if it has the information in its cache. But if you look inside the packets, you should find what you're looking for:

  • requests from the clients to the proxy will contain the target server name (look for the Host HTTP header);
  • requests from the proxy to the target server might (depending on your proxy configuration) contain the IP address of the client (look for the X-Forwarded-For HTTP header).

Note that in the second case, with a caching proxy you'll only find the IP address of the first client requesting a given cacheable resource.

If you're trying to handle encrypted connections things get a bit more complicated; I'll let you read up on that (see Wireshark's page on the subject and Squid's)...

  • Yes I am using transparent proxy – Hafiz Muhammad Shafiq Nov 8 '16 at 8:17
  • Are you using a GRE tunnel or just DNAT/SNAT? – Stephen Kitt Nov 8 '16 at 8:23
  • 1
    No there is no seprate router – Hafiz Muhammad Shafiq Nov 8 '16 at 9:40
  • 1
    You can also run two instances of tcpdump on each interface, writing the captured data to a dump file. Then use mergecap (usually included in the wireshark package) to combine both dump files into one according to timestamp. then you can use wireshark (or tcpdump if you prefer) to examine the dump. – wurtel Nov 8 '16 at 15:58
  • 1
    @wurtel I don't think that's the issue here, the problem is matching up ingress and egress traffic. In any case, on Linux you can also run tcpdump -i any to grab all traffic on all interfaces (in non-promiscuous mode, but that's not necessary here). – Stephen Kitt Nov 8 '16 at 16:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.