Running it behind a load balancer

[bharatbots]

When I run it behind an AWS load balancer, it can't capture the real client IPs(x-forwarded-for). The API can grab the real IP with nginx or by parsing http headers but is there any way to extract real client IPs using dpkt?

Currently in my setup, ip_pkt.src returns a load balancer IP instead of real client IP.

Is it an inherent limitation of this software? Should I not use a load balancer and directly expose the app to the internet?

Edit: Is it possible have support for Proxy Protocol so we're able to easily get the original client IP?

[bharatbots]

I wrote a dpkt parser to extract the X-Forwarded-For HTTP header and it works but the current process_packet implementation seems to be filtering out specific TCP packet types(SYN and not ACK). I'm not able to get all the required info from a single TCP packet. Maybe some info is on the next packet.

def get_real_ip(ip, tcp):
    try:
        request = dpkt.http.Request(tcp.data)
    except (dpkt.dpkt.NeedData, dpkt.dpkt.UnpackError):
        return None

    if "x-forwarded-for" in request.headers:
        real_ip = request.headers["x-forwarded-for"]
        return real_ip
    return None

I don't understand networking stuff, especially the lower level stuff. I hope you can add support for extracting real client IPs from TCP packets(either by parsing HTTP headers or by adding support for Proxy Protocol)

As a side note, Proxy Protocol isn't supported by all load balancers so in some cases parsing HTTP headers may seem like the only option.

[NikolaiT]

I don't understand networking stuff

Me neither ;)

If you are behind a load balancer, then your load balancer will need to forward the real client IP address by some HTTP header.

I don't extract the real client with pcap, I do so on the API:

https://github.com/NikolaiT/zardaxt/blob/b0ee751fa1e47c77b114b21670875fcef5b05528/zardaxt_api.py#L26C9-L26C15