Hello again,
here is an example output from tcpdump between webserver and load balancer.
As you can see, there is no X-Forwarded-For: header for POST requests with Mozilla.
Regards
Sirko
">"IP 212.204.60.1.58007 > 212.204.60.8.80: P 2662937837:2662938294(457) ack 3511184339 win 33304 <nop,nop,timestamp 1238903793 19671791>
">"...`
">"......"..E....A@.@.g...<...<....P..4..Hk............
">"I.+..,*.GET /who.html HTTP/1.1
">"Host: www.warimknast.de
">"User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8b2) Gecko/20050620 Camino/0.9a1
">"Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
">"Accept-Language: en,de;q=0.7,ja;q=0.3
">"Accept-Encoding: gzip,deflate
">"Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
">"Keep-Alive: 300
">"Connection: keep-alive
">"X-Forwarded-For: 212.204.60.39
">"
">"
">"
">"IP 212.204.60.8.80 > 212.204.60.1.58007: . ack 457 win 33304 <nop,nop,timestamp 19673167 1238903793>
">"....."...`
">"...E..4.9@.@.)...<...<..P...Hk...6.....6J.....
">"
">" .,0OI.+.
">"IP 212.204.60.8.80 > 212.204.60.1.58007: P 1:509(508) ack 457 win 33304 <nop,nop,timestamp 19673181 1238903793>
">"....."...`
">"...E..0.F@.@.8...<...<..P...Hk...6............
">".,0]I.+.HTTP/1.1 200 OK
">"Date: Wed, 24 Aug 2005 12:40:18 GMT
">"Server: Apache/1.3.33 (Unix) mod_gzip/1.3.26.1a mod_ssl/2.8.22 OpenSSL/0.9.7e
">"Content-Location: who.html.php
">"TCN: choice
">"Vary: negotiate,Accept-Encoding,U
">"X-Powered-By: PHP/4.3.11
">"Keep-Alive: timeout=15, max=98
">"Connection: Keep-Alive
">"Transfer-Encoding: chunked
">"Content-Type: text/html
">"
">"92
">"<html><head><title>who am i</title></head><body>
">"<form action="who.html" method="post">
">"<input type="submit" value="212.204.60.39">
">"</form></html>
">"0
">"
">"
">"
">"
">"
">"
">"IP 212.204.60.1.58007 > 212.204.60.8.80: P 457:925(468) ack 509 win 33304 <nop,nop,timestamp 1238905137 19673181>
">"...`
">"......"..E...HR@.@.....<...<....P..6..Hm.....C......
">"I.11.,0]POST /who.html HTTP/1.1
">"Host: www.warimknast.de
">"User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8b2) Gecko/20050620 Camino/0.9a1
">"Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
">"Accept-Language: en,de;q=0.7,ja;q=0.3
">"Accept-Encoding: gzip,deflate
">"Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
">"Keep-Alive: 300
">"Connection: keep-alive
">"Referer: http://www.warimknast.de/who.html
">"
">"IP 212.204.60.8.80 > 212.204.60.1.58007: . ack 925 win 33304 <nop,nop,timestamp 19673302 1238905137>
">"....."...`
">"...E..4.m@.@.,...<...<..P...Hm...8.....,......
">"
">" .,0.I.11
">"IP 212.204.60.1.58007 > 212.204.60.8.80: P 925:995(70) ack 509 win 33304 <nop,nop,timestamp 1238905239 19673302>
">"...`
">"......"..E..z#G@.@.....<...<....P..8..Hm............
">"I.1..,0.Content-Type: application/x-www-form-urlencoded
">"Content-Length: 0
">"
">"
">"IP 212.204.60.1.58007: . ack 995 win 33304 <nop,nop,timestamp 19673312 1238905239>
">"....."...`
">"...E..4..@.@.q...<...<..P...Hm...8.....+......
">"
">" .,0.I.1.
">"IP 212.204.60.1.58007: P 509:961(452) ack 995 win 33304 <nop,nop,timestamp 19673318 1238905239>
">"....."...`
">"...E.....@.@.$Q..<...<..P...Hm...8............
">".,0.I.1.HTTP/1.1 200 OK
">"Date: Wed, 24 Aug 2005 12:40:20 GMT
">"Server: Apache/1.3.33 (Unix) mod_gzip/1.3.26.1a mod_ssl/2.8.22 OpenSSL/0.9.7e
">"X-Powered-By: PHP/4.3.11
">"Vary: Accept-Encoding,U
">"Keep-Alive: timeout=15, max=97
">"Connection: Keep-Alive
">"Transfer-Encoding: chunked
">"Content-Type: text/html
">"
">"91
">"<html><head><title>who am i</title></head><body>
">"<form action="who.html" method="post">
">"<input type="submit" value="212.204.60.1">
">"</form></html>
">"0
Received on Wed Aug 24 2005 - 15:09:13 CEST
This archive was generated by hypermail 2.2.0 : Wed Aug 24 2005 - 15:09:14 CEST