Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've noticed that some traffic coming to my web sites reports a different source IP depending on whether or not the connection is secure. I have two different hostnames, one of which is HTTP, the other, HTTPS, which point to different IPs on the same server. I'm seeing this from users coming from specific networks:

Requests to come from
Requests to come from

The secure source IP is often just one off from the non-secure source IP, and I'm pretty sure it's the same user making the requests.

What is the benefit of setting up a network like this? I'm assuming it has something to do with security or analytics, but I can't think of a reason why.

share|improve this question
Do the requests have an X-Forwarded-For header? – polynomial Oct 5 '11 at 1:00
I'm unfortunately unable to see at the moment, since IIS does not log that header automatically. – Evan M Oct 5 '11 at 13:14
up vote 2 down vote accepted

There are a few possible benefits from setting up a proxy system this way:

  • Allows you to classify traffic in your network for QoS/Policing on Layer 3 only devices
  • More available ephemeral ports
  • Allows you to bypass traffic throughput licensing limitations on an IDS by excluding traffic it may not be able to inspect
  • Lets you troll other admins/log watchers who go 'huh' when they see your traffic!

There are also a few downsides:

  • Some sites use IP information for visitor tracking and this could break things (this is pretty rare)
  • Makes diagnosing problems more difficult as traffic may come from two different places
  • Depending on how close the IP addresses are (netblock wise) it could actually take a different route over the internet which could mean confusing performance issues
share|improve this answer
Thanks, that was very helpful! – Evan M Oct 10 '11 at 4:29

My guess would be they are using some sort of firewall/proxy that is content scrubbing HTTP requests, but is unable to scrub HTTPS requests, so those go out via another source. I'd really be surprised if a large percentage of your traffic appears this way.

share|improve this answer
It's definitely a minority. Only a small handful of our users come from a network that does this, though it's enough to cause me grief. – Evan M Oct 3 '11 at 12:58
This is a guess at how they are doing it, the question was what are the possible benefits. – polynomial Oct 8 '11 at 20:47

They probably have transparent caching proxy (squid?), which uses one IP and all other direct traffic (including HTTPS) is going to your server directly using another IP.

share|improve this answer
This is a guess at how they are doing it, the question was what are the possible benefits. – polynomial Oct 8 '11 at 20:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.