identify the servers on which the proxy server is installed

[Arturxr]

It is necessary to identify the servers on which the proxy server is installed. If there is a CheckPoint between the client and the proxy server, then we partially see this traffic, but this is only part of the total traffic.

for example: we have a rule that blocks port 3128, how can we find all traffic based on it?

it is necessary to develop a solution to determine proxy servers by the number of sessions or frequent access to search engines.

[G_W_Albrecht]

Make a capture on all servers NIC for port 3128 and you will see which servers send such traffic.

[Chris_Atkinson]

Filter your logs based on the rule/service?