# How to check if XFF is working **URL:** \ **Category:** Technical Forums\ **Tags:** tmsh, security, xff, ltm, application-delivery\ **Created:** [May 10, 2017, 5:09am UTC](https://community.f5.com/t/how-to-check-if-xff-is-working/62526 "2017-05-10T05:09:02Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Nath](https://avatars.discourse-cdn.com/v4/letter/n/b38774/32.png) [@Nath](https://community.f5.com/u/Nath)\ **Post date:** [May 10, 2017, 5:09am UTC](https://community.f5.com/t/how-to-check-if-xff-is-working/62526/1 "2017-05-10T05:09:02Z")
Anyone I am looking for a way to check if XFF is working in bigip aside from checking it to Wireshark. Server team keep on claiming that they still see the bigip SNAT IP on their end. Thank you -Nat ---
**Author:** ![Ryannnnnnnnn](https://avatars.discourse-cdn.com/v4/letter/r/a9adbd/32.png) [@Ryannnnnnnnn](https://community.f5.com/u/Ryannnnnnnnn)\ **Post date:** [May 10, 2017, 5:37am UTC](https://community.f5.com/t/how-to-check-if-xff-is-working/62526/2 "2017-05-10T05:37:46Z")
The pool member will still see the SNAT IP as the source IP. However, with XFF enabled the http request header will have the real client ip included as an additional field. Aside from checking the http profile/iRule that you’ve configured you could capture the server side request to confirm that the field is getting inserted but that would obviously require the use of tcpdump/wireshark. ---
**Author:** ![Ryan\_80361](https://avatars.discourse-cdn.com/v4/letter/r/f17d59/32.png) [@Ryan\_80361](https://community.f5.com/u/Ryan_80361)\ **Post date:** [May 10, 2017, 5:37am UTC](https://community.f5.com/t/how-to-check-if-xff-is-working/62526/3 "2017-05-10T05:37:46Z")
The pool member will still see the SNAT IP as the source IP. However, with XFF enabled the http request header will have the real client ip included as an additional field. Aside from checking the http profile/iRule that you’ve configured you could capture the server side request to confirm that the field is getting inserted but that would obviously require the use of tcpdump/wireshark. ---
**Author:** ![Nath](https://avatars.discourse-cdn.com/v4/letter/n/b38774/32.png) [@Nath](https://community.f5.com/u/Nath)\ **Post date:** [May 10, 2017, 7:00am UTC](https://community.f5.com/t/how-to-check-if-xff-is-working/62526/4 "2017-05-10T07:00:54Z")
@Ryan i see, so I think all i can do is to check if they configured they server correctly. ---
**Author:** ![Nath](https://avatars.discourse-cdn.com/v4/letter/n/b38774/32.png) [@Nath](https://community.f5.com/u/Nath)\ **Post date:** [May 10, 2017, 7:00am UTC](https://community.f5.com/t/how-to-check-if-xff-is-working/62526/5 "2017-05-10T07:00:54Z")
@Ryan i see, so I think all i can do is to check if they configured they server correctly. ---
**Author:** ![Ryan\_80361](https://avatars.discourse-cdn.com/v4/letter/r/f17d59/32.png) [@Ryan\_80361](https://community.f5.com/u/Ryan_80361)\ **Post date:** [May 10, 2017, 7:11am UTC](https://community.f5.com/t/how-to-check-if-xff-is-working/62526/6 "2017-05-10T07:11:48Z")
Yep, Check out [K4816](https://support.f5.com/csp/article/K4816) and look towards the bottom of the page for the section titled _Configuring the web server to extract the IP address from the HTTP header_ for extra info on configuring the web server. ---
**Author:** ![Ryannnnnnnnn](https://avatars.discourse-cdn.com/v4/letter/r/a9adbd/32.png) [@Ryannnnnnnnn](https://community.f5.com/u/Ryannnnnnnnn)\ **Post date:** [May 10, 2017, 7:11am UTC](https://community.f5.com/t/how-to-check-if-xff-is-working/62526/7 "2017-05-10T07:11:48Z")
Yep, Check out [K4816](https://support.f5.com/csp/article/K4816) and look towards the bottom of the page for the section titled _Configuring the web server to extract the IP address from the HTTP header_ for extra info on configuring the web server.