Chase Seibert

Director of Engineering at Dropbox

Here are some quick recipes for getting information from varnish about top offending IP addresses, which pages those IP addresses are accessing, and which IPs are hitting particular pages. 

# top IP addresses
varnishtop -i TxHeader -I '^X-Forwarded-For:'

# which pages the IP address 66.249.68.228 is hitting
varnishncsa |grep 66.249.68.228 |awk '{print $7}'

# IP addresses hitting the /client-perf URL
varnishlog -m 'RxURL:/client-perf' |grep 'X-Forwarded-For'