# Determining remote proxy servers using Bro.

**URL:** https://community.zeek.org/t/determining-remote-proxy-servers-using-bro/4274
**Category:** Zeek
**Created:** [July 29, 2016, 6:17pm UTC](https://community.zeek.org/t/determining-remote-proxy-servers-using-bro/4274 "2016-07-29T18:17:37Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![fatema\_bannatwala](https://avatars.discourse-cdn.com/v4/letter/f/5f9b8f/32.png) [@fatema\_bannatwala](https://community.zeek.org/u/fatema_bannatwala)
#### Post date: [July 29, 2016, 6:17pm UTC](https://community.zeek.org/t/determining-remote-proxy-servers-using-bro/4274/1 "2016-07-29T18:17:37Z")

</div>

Hi,

Recently we have seen an uptick in use of proxy servers to login to the accounts from people living in China. And since the connection appears to come from US based IP address (probably a proxy) they go un-flagged by the IDS/IPS devices, as they see normal logins from United States IP addresses.  
So my question is, is there a way to determine that the incoming connection from an IP is actually a proxy server’s IP, by looking at some unique patterns in data collected by IDS/IPS devices? and if so can we do it using Bro?

Thanks,  
Fatema.

---

<div class="post-metadata">

### Author: ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)
#### Post date: [August 3, 2016, 7:42pm UTC](https://community.zeek.org/t/determining-remote-proxy-servers-using-bro/4274/2 "2016-08-03T19:42:32Z")

</div>

Hi Fatema,

one idea would be to look if the used proxy servers set a header like,  
X-Forwarded-For ([https://en.wikipedia.org/wiki/X-Forwarded-For](https://en.wikipedia.org/wiki/X-Forwarded-For)). If such a  
header is present, you already might have an entry in the proxied column  
of http.log.

I hope this helps,  
Johanna

---

<div class="post-metadata">

### Author: ![fatema\_bannatwala](https://avatars.discourse-cdn.com/v4/letter/f/5f9b8f/32.png) [@fatema\_bannatwala](https://community.zeek.org/u/fatema_bannatwala)
#### Post date: [August 4, 2016, 8:07pm UTC](https://community.zeek.org/t/determining-remote-proxy-servers-using-bro/4274/3 "2016-08-04T20:07:15Z")

</div>

Thanks Johanna,

Didn’t realized that the “Proxied” field in http.log serves the purpose. Thanks for the suggestion.

-Fatema

---

<div class="post-metadata">

### Author: ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/determining-remote-proxy-servers-using-bro/4274/4 "2022-05-06T15:43:54Z")

</div>