From owner-freebsd-questions Thu Jul 27 2:12:24 2000 Delivered-To: freebsd-questions@freebsd.org Received: from alpha.root-servers.ch (alpha.root-servers.ch [195.49.62.125]) by hub.freebsd.org (Postfix) with SMTP id 689B037C09D for ; Thu, 27 Jul 2000 02:12:20 -0700 (PDT) (envelope-from gabriel_ambuehl@buz.ch) Received: (qmail 31432 invoked from network); 27 Jul 2000 09:12:18 -0000 Received: from client98-229.hispeed.ch (HELO 10.2.2.100) (62.2.98.229) by ns1.root-servers.ch with SMTP; 27 Jul 2000 09:12:18 -0000 Date: Thu, 27 Jul 2000 11:13:39 +0200 From: Gabriel Ambuehl X-Mailer: The Bat! (v1.45 Beta/6) Personal Organization: BUZ Internet Services X-Priority: 3 (Normal) Message-ID: <155580301839.20000727111339@buz.ch> To: "Noor Dawod" Cc: freebsd-questions@FreeBSD.org Subject: Re: one IP, multiple hosts. In-reply-To: References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG Hello Noor, Thursday, July 27, 2000, 9:10:21 AM, you wrote: > Suppose you have one IP, 192.168.10.80, which is the IP of many hosted > domains (and their respective hosts) on a certain web server. Using Apache's > NameVirtualHost and VirtualHost directives, I can direct the flow of packets > being sent to the same IP to different hosts. > My question is: using tcpdump, trafshow, snort, or any other program I don't > know about, how can I know which host is being accessed when the only > information I got is: IP address, and port number (80 for web) ? You need to look at the application level layer (in this case HTTP and there at HTTP_HOST (not sure how the field is called in HTTP, that's the name that CGI uses for it)). Best regards, Gabriel To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message