[Oisf-users] Suricata X-Forwarded For Question

[Kevin Ross]

Hi,

I use X-Forwarded-For overwriting. I have new proxies though and before it
would be typically a single IP but now it is X-Forwarded-For: CLIENT_IP,
127.0.0.1.

I have no idea why this is the case it would add that in but basically
Suricata is taking the loopback as the overwrite address. Can I specify
which which one to use? If not I will need to disable this which I would
prefer not to until vendor responds :(


Thanks,
Kevin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20141028/e3f5edf7/attachment-0001.html>