Over AWS ELB: how to capture the real IP address from "netstat"?

Question

I am using AWS Elastic Load Balancing (ELB)in front of two Linux web servers. But (based on my requirement) I need to know the real IP addresses in terms of web servers, especially when I use it netstat.

I need to know the number of incoming connections from each IP address (from NETSTAT) , as in real time. So, basically on Linux (without ELB ahead), the command netstatworks just fine:

netstat -tn 2>/dev/null | grep :80

But now I can only see the internal IP addresses of ELB ; which makes it all pretty complicated.

What is the solution for this please? Thank.

Answer 1

You can get the client IP address from ELB access logs and use EMR with Hive to calculate the number of requests received from the client with the same IP.

Answer 2

If you prefer more “manual” methods: you can use tcpdump or ngrep and look for the “x-forwarded-for” header on your web servers.

If you need the right way: set some logging in your application, log client requests with the x-forwarded-for header.

, agentwatch logs . , AWS ( ), , , , , . , .