https://community.checkpoint.com/t5/Firewall-and-Security-Management/identify-the-servers-on-which-the-proxy-server-is-installed/m-p/159793#M28084 <P>It is necessary to identify the servers on which the proxy server is installed. If there is a CheckPoint between the client and the proxy server, then we partially see this traffic, but this is only part of the total traffic.</P><DIV class="">&nbsp;</DIV><P>for example: we have a rule that blocks port 3128, how can we find all traffic based on it?</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Arturxr_1-1666081807917.png" style="width: 400px;"><img src="https://community.checkpoint.com/t5/image/serverpage/image-id/18151i35637BCBB5CF0CDF/image-size/medium?v=v2&amp;px=400" role="button" title="Arturxr_1-1666081807917.png" alt="Arturxr_1-1666081807917.png" /></span></P><P>it is necessary to develop a solution to determine proxy servers by the number of sessions or frequent access to search engines.</P> Tue, 18 Oct 2022 08:34:20 GMT Arturxr 2022-10-18T08:34:20Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/identify-the-servers-on-which-the-proxy-server-is-installed/m-p/159793#M28084 <P>It is necessary to identify the servers on which the proxy server is installed. If there is a CheckPoint between the client and the proxy server, then we partially see this traffic, but this is only part of the total traffic.</P><DIV class="">&nbsp;</DIV><P>for example: we have a rule that blocks port 3128, how can we find all traffic based on it?</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Arturxr_1-1666081807917.png" style="width: 400px;"><img src="https://community.checkpoint.com/t5/image/serverpage/image-id/18151i35637BCBB5CF0CDF/image-size/medium?v=v2&amp;px=400" role="button" title="Arturxr_1-1666081807917.png" alt="Arturxr_1-1666081807917.png" /></span></P><P>it is necessary to develop a solution to determine proxy servers by the number of sessions or frequent access to search engines.</P> Tue, 18 Oct 2022 08:34:20 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/identify-the-servers-on-which-the-proxy-server-is-installed/m-p/159793#M28084 Arturxr 2022-10-18T08:34:20Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/identify-the-servers-on-which-the-proxy-server-is-installed/m-p/159811#M28095 <P>Make a capture on all servers NIC for port 3128 and you will see which servers send such traffic.</P> Tue, 18 Oct 2022 09:32:29 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/identify-the-servers-on-which-the-proxy-server-is-installed/m-p/159811#M28095 G_W_Albrecht 2022-10-18T09:32:29Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/identify-the-servers-on-which-the-proxy-server-is-installed/m-p/159815#M28099 <P>Filter your logs based on the rule/service?</P> Tue, 18 Oct 2022 10:51:09 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/identify-the-servers-on-which-the-proxy-server-is-installed/m-p/159815#M28099 Chris_Atkinson 2022-10-18T10:51:09Z