# How to detect transparent proxy by BRO IDS (2.4.1)

**URL:** <https://community.zeek.org/t/how-to-detect-transparent-proxy-by-bro-ids-2-4-1/4429>\
**Category:** Zeek\
**Created:** [October 24, 2016, 4:36am UTC](https://community.zeek.org/t/how-to-detect-transparent-proxy-by-bro-ids-2-4-1/4429 "2016-10-24T04:36:08Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hafiz\_Shafiq](https://avatars.discourse-cdn.com/v4/letter/h/8491ac/32.png) [@Hafiz\_Shafiq](https://community.zeek.org/u/Hafiz_Shafiq)\
**Post date:** [October 24, 2016, 4:36am UTC](https://community.zeek.org/t/how-to-detect-transparent-proxy-by-bro-ids-2-4-1/4429/1 "2016-10-24T04:36:08Z")

</div>

Sir,  
Our network administrator is using proxy in transparent mode (SQUID). In this mode , there is no need for user to configure proxy option on his computer. I have captured few hours traffic via tcpdump and when I run bro, to know about http trafffic and defferent apps used (like google, youtube etc.). I am amazed to know that there is even not http.log and app\_stats.log files generated. Is it some problem in bro configuration. I have searched from its manual, infomation given about proxy could not solve my problem. I have checked load\_scripts.log. I shows that http analyzer is loaded.  
Can you please guide me about this issue ?

Regards

Hafiz Muhammad Shafiq

---

<div class="post-metadata">

**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\
**Post date:** [October 25, 2016, 7:02pm UTC](https://community.zeek.org/t/how-to-detect-transparent-proxy-by-bro-ids-2-4-1/4429/2 "2016-10-25T19:02:09Z")

</div>

Hi Hafiz,

there is no reason why Bro should not log HTTP sessions when there is a  
transparent proxy (which, as the name suggest, should also be transparent  
to Bro). Hence I assume there is something different going on.

Do your conn.log entries look like Bro sees entire TCP sessions?

Johanna

---

<div class="post-metadata">

**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\
**Post date:** [October 25, 2016, 7:37pm UTC](https://community.zeek.org/t/how-to-detect-transparent-proxy-by-bro-ids-2-4-1/4429/3 "2016-10-25T19:37:13Z")

</div>

FWIW I do this at home with squid. If you have bro listening on the external and internal as I do you'll see something like this on the external:

2016-10-25T13:19:54-0600 CSBm181DwlSMeM1Jkl ext.ip.address 35292 151.101.52.246 80 1 GET [i.scdn.co](http://i.scdn.co) /image/bfe99c49e55b1b0881da51b6820051673071c34e - Spotify/6.3.0 Android/22 (LG-ls990) 0 94040 200 OK - - - (empty) - - VIA -\> 1.1 gateway (squid/3.5.22),X-FORWARDED-FOR -\> 192.168.1.101 - - F898pvpKI8FAldYVb image/jpeg -

If you're only listening internal, you may not have any evidence to show proxied information:

2016-10-25T13:19:54-0600 CKUVZB4Buv5shQEfre 192.168.1.101 45741 151.101.52.246 80 1 GET [i.scdn.co](http://i.scdn.co) /image/bfe99c49e55b1b0881da51b6820051673071c34e - Spotify/6.3.0 Android/22 (LG-ls990) 0 94040 200 OK - - - (empty) - - - -- FIcIh42olruCzFTJgl image/jpeg -

Hope that helps.

James

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/how-to-detect-transparent-proxy-by-bro-ids-2-4-1/4429/4 "2022-05-06T15:44:10Z")

</div>