Tracking Public IPs from Web Server in the DMZ

[david.johnson]

I am wondering if it is possible to track IP addresses of computers on the Internet that make requests to a Web Server in the DMZ behind a PIX 515. When looking at the communication to the Web server, the request comes in as originating from the DMZ interface of the PIX. Is there a way to see what the external IP is that the PIX 515 DMZ interface is NAT ing and see this from the Web server?

[mchin345]

You can place an IDS before the PIX and get these details.

[Patrick Iseli]

You could use NTOP or send informational syslog infos to a syslog server and then filter that flat file for the information that you are interested in.

http://www.ntop.org/ntop.html

PIX settings:

fixup protocol http 80

logging on

logging timestamp

logging trap informational

logging facility 21

logging host inside 192.x.y.z

A good syslog (server) utility is:

FREE: http://www.kiwisyslog.com/

$$$: http://www.sawmill.net/

sincerely

Patrick