X-Forwarded-For (XFF) and True-Client-IP (TCIP) support is available on the following TippingPoint devices;

• S-Series (10/110/330) with TOS v3.6.1 or higher
• N-Platform (660N, 1400N, 2500N, 5100N, 6100N) with TOS v3.6.1 or higher
• NX-Platform (2600NX, 5200NX, 6200NX, 7100NX, 7500NX) with TOS v3.6.0 or higher
• TPS Series (440T, 2200T), all TOS
• Security Management System (SMS) with SMSv3.6.0 or higher

Note 1: In the SMS, XFF and TCIP settings is configured through the SMS Profile area, and is displayed in the SMS Events area.

HTTP Uniform Resource Identifier (URI)support is available on the following TippingPoint devices;

• N-Platform (660N, 1400N, 2500N, 5100N, 6100N) with TOS v3.8.0 or higher
• NX-Platform (2600NX, 5200NX, 6200NX, 7100NX, 7500NX) with TOS v3.8.0 or higher
• TPS Series (440T, 2200T), all TOS
• SSecurity Management System (SMS) with SMSv4.1.0 or higher

Note 2: Enabling HTTP context information can impact system performance.

Note 3: In the SMS, the HTTP URI setting is configured through the SMS Profile area, and is displayed in the SMS Events area.

Note 4: In the SMS Events area, an icon appears if any additional information about an event is detected (the Capture Additional Event Information feature must be enabled). If the additional event information option has been selected, this panel provides the client IP address and hostname information associated with any HTTP URI. XFF and TCIP technology captures a client IP address before it can be overwritten by a forwarding proxy IP address. In addition to the previous XFF and TCIP data, the Additional Info field includes the attacker’s HTTP method, HTTP host, and HTTP URI information. When you click the icon, a dialog displays any of the additional information that was captured. The data collected with this feature is used for logging purposes only. Additional information for this panel includes values for the following possible categories:

• X-Forwarded-For
• True-Client-IP
• URI Method
• URI Hostname
• URI