The http_true_ip sticky buffer provides the original IP address of the client sending the request as it's stored by a proxy in the request message headers. Specifically, it is the last IP address listed in the "X-Forwarded-For" and "True-Client-IP" headers, or any other custom "X-Forwarded-For-type" header. If a request contains multiple headers of this type, then the preference defined in the xff_headers configuration variable is taken into account when determining which header value to include in this buffer.




http_true_ip; content:"";
http_true_ip; content:"";