I see sometimes some traffic pattern which I don't fully understand, and I hope I can get some help.
Let's say I run a website. I look at the logs coming in for my http site and I see a request proxied by squid (header
Via is telling me about squid). No problem there, someone is being proxied via squid.
But then I look at the IPs. The connecting IP (188.8.131.52) is consistent to where the end-user is actually physically located. However, the
X-Forwarded-For header shows an IP which is -- for the sake of discussion -- EC2 (184.108.40.206).
So this could tell me that someone using 220.127.116.11 is being proxied to a squid running on 18.104.22.168. But this doesn't make sense because I know the person is located at 22.214.171.124. So overall it looks like someone at 126.96.36.199 is using a squid on EC2, which does something (maybe security?) which adds a XFF and Via header and then tunnels back to 188.8.131.52 and goes out to the internet.
This last scenario seems convoluted (and very slow adding an extra "hop") but maybe I am missing some use-case or setup which some IT might decide to do.
Does anyone know what's going on? Thanks!
PS: let's assume none is spoofing headers! As this does happen regularly, although I would call it a corner-case.