up vote 3 down vote favorite
1
share [g+] share [fb]

I've noticed that some traffic coming to my web sites reports a different source IP depending on whether or not the connection is secure. I have two different hostnames, one of which is HTTP, the other, HTTPS, which point to different IPs on the same server. I'm seeing this from users coming from specific networks:

Requests to http://www.example.com come from 1.1.1.1
Requests to https://secure.example.com come from 1.1.1.2

The secure source IP is often just one off from the non-secure source IP, and I'm pretty sure it's the same user making the requests.

What is the benefit of setting up a network like this? I'm assuming it has something to do with security or analytics, but I can't think of a reason why.

link|improve this question
Do the requests have an X-Forwarded-For header? en.wikipedia.org/wiki/X-Forwarded-For – polynomial Oct 5 '11 at 1:00
I'm unfortunately unable to see at the moment, since IIS does not log that header automatically. – Evan M Oct 5 '11 at 13:14
feedback

3 Answers

up vote 2 down vote accepted
+50

There are a few possible benefits from setting up a proxy system this way:

  • Allows you to classify traffic in your network for QoS/Policing on Layer 3 only devices
  • More available ephemeral ports
  • Allows you to bypass traffic throughput licensing limitations on an IDS by excluding traffic it may not be able to inspect
  • Lets you troll other admins/log watchers who go 'huh' when they see your traffic!

There are also a few downsides:

  • Some sites use IP information for visitor tracking and this could break things (this is pretty rare)
  • Makes diagnosing problems more difficult as traffic may come from two different places
  • Depending on how close the IP addresses are (netblock wise) it could actually take a different route over the internet which could mean confusing performance issues
link|improve this answer
Thanks, that was very helpful! – Evan M Oct 10 '11 at 4:29
feedback
up vote 1 down vote

My guess would be they are using some sort of firewall/proxy that is content scrubbing HTTP requests, but is unable to scrub HTTPS requests, so those go out via another source. I'd really be surprised if a large percentage of your traffic appears this way.

link|improve this answer
It's definitely a minority. Only a small handful of our users come from a network that does this, though it's enough to cause me grief. – Evan M Oct 3 '11 at 12:58
This is a guess at how they are doing it, the question was what are the possible benefits. – polynomial Oct 8 '11 at 20:47
feedback
up vote 1 down vote

They probably have transparent caching proxy (squid?), which uses one IP and all other direct traffic (including HTTPS) is going to your server directly using another IP.

link|improve this answer
This is a guess at how they are doing it, the question was what are the possible benefits. – polynomial Oct 8 '11 at 20:47
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.