Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am running an application server and logging all requests for analysis purposes later. One interesting trend I noticed last night was, I had a visitor from Texas on FIOS share identical traffic with bluecoat in California.

What would cause the traffic to be identical? For every request the visitor made, bluecoat made one subsequently within milliseconds of his request. If it is caching, why would there be identical requests? Wouldn't it go through the cache / proxy on their end, and I would only see the proxied request?

I'm just curious, this is an interesting pattern that shows similarities of a DDoS attack, but with far fewer resources. Is it possible that the visitor had malware on their computer?

Any other ideas?

share|improve this question
    
wouldn't say its a ddos attack I'd say its an information disclosure attack. –  tony roth Jun 8 '10 at 15:56
2  
It is rare, but there are web-conference tools that allow you to synchronize web browsing between multiple parties. –  Zoredache Jun 8 '10 at 16:53
add comment

5 Answers

This is most likely BlueCoat's "WebPulse" service.

When a user accesses a URL through a BlueCoat Proxy and BlueCoat doesn't have any information on that URL, it can be reported back to "WebPulse", which then scans the URL looking for malware, etc.

The first request will be the user accessing the URL, the second is WebPulse doing its scan on the same URL.

share|improve this answer
    
+1 You can find some documentation at kb.bluecoat.com/index?page=content&id=KB3400 –  pehrs May 1 '11 at 12:30
add comment

It might be due to various issues: 1 - An attacker is trying to confuse App. server caching using tunneled connections.

2 - A regular user is connecting through a mis-configured VPN+proxy which duplicates the traffic by sending a copy from each site.

3 - A S-NAT issue.

4 - or may be an issue with your own proxy (I don't know whther you have)

share|improve this answer
add comment

This sounds like a replay attack

Wikipedia:

A replay attack is a form of network attack in which a valid data transmission is maliciously or fraudulently repeated or delayed. This is carried out either by the originator or by an adversary who intercepts the data and retransmits it, possibly as part of a masquerade attack by IP packet substitution (such as stream cipher attack).

share|improve this answer
add comment

They're using a web page sharing service, that allows people to 'surf together'.

share|improve this answer
add comment

I'm not too familiar with BlueCoat, but they do offer caching and filtering services. They could be grabbing your content for that purpose.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.