Extract Insightful Data From Proxy Protocol Packets Blog

DisableTLSDetection.sh

tshark -disable-protocol tls -Y proxy.src.ipv4 -V

FindPROXYPacketSourceIP.sh

tshark -r FILENAME -Y proxy.src.ipv4

PacketCaptureTest.sh

tshark -f "tcp port not 22" -a "duration:5"

TestPROXYRequests.sh

curl --haproxy-protocol http://<your load balancer>/...

TestProxyRequestsOutput.sh

*   Trying ::1:80...
* connect to ::1 port 80 failed: Connection refused
*   Trying 127.0.0.1:80...
* Connected to localhost (127.0.0.1) port 80 (#0)
> PROXY TCP4 127.0.0.1 127.0.0.1 53606 80
> GET / HTTP/1.1
> Host: localhost
> User-Agent: curl/7.74.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 302 Found
< content-length: 0
< location: /hapee-stats
< cache-control: no-cache
<
* Connection #0 to host localhost left intact

TSharkInstallRHEL.sh

sudo yum install wireshark

TSharkInstallUbuntuDebian.sh

sudo apt-get install tshark

ViewPacketContentsOutput.sh

ubuntu@bk:/etc/hapee-2.6# tshark  -Y proxy.src.ipv4 -V
...
PROXY Protocol
    Magic: 0d0a0d0a000d0a515549540a
    0010 .... = Version: 2
    .... 0001 = Command: 1
    [Version: 2]
    Address Family Protocol: TCP over IPv4 (0x11)
        0001 .... = Address Family: IPv4 (0x1)
        .... 0001 = Protocol: 0x1
    Length: 12
    Source Address: 192.168.64.1
    Destination Address: 192.168.64.120
    Source Port: 49344
    Destination Port: 8081

ViewPROXYPacketArgument.sh

tshark -r FILENAME -Y proxy.src.ipv4 -V