Monitoring with a CA Standard Monitor › Support for XFF Translation › How XFF Translation Works

How XFF Translation Works

The management console uses the X-Forwarded-For (XFF) HTTP header to identify a client’s originating IP address when the client connects to a Web application through an HTTP proxy server that uses XFF. The typical XFF HTTP header format follows:

TCP Source IP: proxy3
X-Forwarded-For: client1, proxy1, proxy2

The list of IP addresses includes the farthest downstream client plus each successive proxy that passed the request and the proxy from which it received the request. In the example, the request passed proxy1, proxy2, and proxy3 (the closest proxy to the server).

Using XFF translation, the management console properly reports each client’s Web traffic as belonging to the subnet that fits. In the management console, you will start seeing the proper volume of Web application traffic to and from the clients. You will also see a small amount of traffic on the proxy servers. The traffic consists of acknowledgements that the proxy server sends to the Web servers, not transactional traffic.

Tip: If you define the proxy server as its own network in a proxy environment, you can distinguish between performance on the Web server to proxy server link versus performance on the Web server to client subnet complete path. This is useful information if the proxy server is not co-located with the clients.