X-Forwarded-For (XFF) and True-Client-IP (TCIP) support is available on the following TippingPoint devices;
- Threat Protection System (TPS) on all supported models and operating systems.
- Security Management System (SMS) on all supported models and operating systems.
NOTES:
- XFF or TCIP settings are configured through the SMS Profile area and are displayed in the SMS Events area.
- XFF or TCIP are not supported with Traffic Management Filters (TMFs).
HTTP Uniform Resource Identifier (URI) support is available on the following TippingPoint devices;
- Threat Protection System (TPS) on all supported models and operating systems.
- Security Management System (SMS) on all supported models and operating systems.
NOTES:
- Enabling HTTP context information can impact system performance.
- The HTTP URI setting is configured in the SMS Profile area and displayed in the SMS Events area.
- In the SMS Events area, an icon appears if any additional information about an event is detected (the Capture Additional Event Information feature must be enabled). If the additional event information option has been selected, this panel provides the client IP address and hostname information associated with any HTTP URI. XFF and TCIP technology capture a client IP address before a forwarding proxy IP address can overwrite it. In addition to the previous XFF and TCIP data, the Additional Info field includes the attacker’s HTTP method, HTTP host, and HTTP URI information. When you click the icon, a dialog displays any of the additional information that was captured. The data collected with this feature is used for logging purposes only. Additional information for this panel includes values for the following possible categories:
- X-Forwarded-For
- True-Client-IP
- URI Method
- URI Hostname
- URI