Transparent Proxy TCP handshake

[gmail2]

Hi All

this isn't a cisco specific question, but as I couldn't find a generic networking forum I figured this would be a good place to start. I'm currently troubleshooting an application level problem where the vendor says that there is a transparent proxy (vendor has no access to the proxy or the network equipment). What I want to know is, if I run netstat (or wireshark) where would I see the TCP session to? To the transparent proxy or to the destination host (eg web server) ?

Part of me thinks it would be to the eventual host, given that the client doesn't know about the proxy. But part of me thinks it would have to be to the proxy, as part of the reason why an organisation would have a proxy would be (for example) so that they can restrict internet access on their firewalls, and therefore the tcp session would have to be to the proxy (because the required TCP port might not be open to the destination server).

The reason I'm putting this in a networking forum as opposed to a proxy forum is that I don't beleive transparent proxies work any differently to regular proxies (correct me if I'm wrong) and that it's actually the network config (policy based routing etc) that makes the proxy transparent. But I don't quiet understand how this affects/changes the TCP session - does the router/firewall/something else send an ICMP redirect back to the client ? Or Does the proxy somehow "proxy" the TCP handshake also so tha the client doens't know any better ? (personally I would have thought this wouldn't be allowed/possible)

Any advice would be greatly appreciated
Thanks !!

Irish Poetry - Karen O'Connor
Irish Poetry and Short Stories - Doghouse Books
Garten und Landschaftsbau

 

[dgrizzard]

As with anything it depends... in this case how that specific proxy is setup/works.


This is a very generic layout...


Host--->Switch--->Router\Firewall---Proxy--->Destination\Whatever


The proxy, most of the time but not always, will be physically inline with the data path. This means on either side of the "Proxy" above there is a cable in either end, but there is no IP configuration for that cable.

Again, this depends, but most of the time the proxy will inspect the pack as it passes through the device and then make a determination on what to do with it at that time. If it is allowed through, it does not change the packet and lets it pass.

Now, regarding a TCP session, the proxy can be setup to interrupt TCP sessions to prevent SYN floods. This means the proxy will not allow the TCP session to complete until it sees the full three way handshake.

But again, all of this completely depends on the model/manufacturer and how the proxy itself has been configured.