I am running an application server and logging all requests for analysis purposes later. One interesting trend I noticed last night was, I had a visitor from Texas on FIOS share identical traffic with bluecoat in California.

What would cause the traffic to be identical? For every request the visitor made, bluecoat made one subsequently within milliseconds of his request. If it is caching, why would there be identical requests? Wouldn't it go through the cache / proxy on their end, and I would only see the proxied request?

I'm just curious, this is an interesting pattern that shows similarities of a DDoS attack, but with far fewer resources. Is it possible that the visitor had malware on their computer?

Any other ideas?

  • wouldn't say its a ddos attack I'd say its an information disclosure attack. – tony roth Jun 8 '10 at 15:56
  • 2
    It is rare, but there are web-conference tools that allow you to synchronize web browsing between multiple parties. – Zoredache Jun 8 '10 at 16:53

This is most likely BlueCoat's "WebPulse" service.

When a user accesses a URL through a BlueCoat Proxy and BlueCoat doesn't have any information on that URL, it can be reported back to "WebPulse", which then scans the URL looking for malware, etc.

The first request will be the user accessing the URL, the second is WebPulse doing its scan on the same URL.


It might be due to various issues: 1 - An attacker is trying to confuse App. server caching using tunneled connections.

2 - A regular user is connecting through a mis-configured VPN+proxy which duplicates the traffic by sending a copy from each site.

3 - A S-NAT issue.

4 - or may be an issue with your own proxy (I don't know whther you have)


This sounds like a replay attack


A replay attack is a form of network attack in which a valid data transmission is maliciously or fraudulently repeated or delayed. This is carried out either by the originator or by an adversary who intercepts the data and retransmits it, possibly as part of a masquerade attack by IP packet substitution (such as stream cipher attack).


They're using a web page sharing service, that allows people to 'surf together'.


I'm not too familiar with BlueCoat, but they do offer caching and filtering services. They could be grabbing your content for that purpose.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy