Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am running an application server and logging all requests for analysis purposes later. One interesting trend I noticed last night was, I had a visitor from Texas on FIOS share identical traffic with bluecoat in California.

What would cause the traffic to be identical? For every request the visitor made, bluecoat made one subsequently within milliseconds of his request. If it is caching, why would there be identical requests? Wouldn't it go through the cache / proxy on their end, and I would only see the proxied request?

I'm just curious, this is an interesting pattern that shows similarities of a DDoS attack, but with far fewer resources. Is it possible that the visitor had malware on their computer?

Any other ideas?

share|improve this question
wouldn't say its a ddos attack I'd say its an information disclosure attack. – tony roth Jun 8 '10 at 15:56
It is rare, but there are web-conference tools that allow you to synchronize web browsing between multiple parties. – Zoredache Jun 8 '10 at 16:53

This is most likely BlueCoat's "WebPulse" service.

When a user accesses a URL through a BlueCoat Proxy and BlueCoat doesn't have any information on that URL, it can be reported back to "WebPulse", which then scans the URL looking for malware, etc.

The first request will be the user accessing the URL, the second is WebPulse doing its scan on the same URL.

share|improve this answer
+1 You can find some documentation at – pehrs May 1 '11 at 12:30

It might be due to various issues: 1 - An attacker is trying to confuse App. server caching using tunneled connections.

2 - A regular user is connecting through a mis-configured VPN+proxy which duplicates the traffic by sending a copy from each site.

3 - A S-NAT issue.

4 - or may be an issue with your own proxy (I don't know whther you have)

share|improve this answer

This sounds like a replay attack


A replay attack is a form of network attack in which a valid data transmission is maliciously or fraudulently repeated or delayed. This is carried out either by the originator or by an adversary who intercepts the data and retransmits it, possibly as part of a masquerade attack by IP packet substitution (such as stream cipher attack).

share|improve this answer

They're using a web page sharing service, that allows people to 'surf together'.

share|improve this answer

I'm not too familiar with BlueCoat, but they do offer caching and filtering services. They could be grabbing your content for that purpose.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.