ah yes. actually IWSS of trendMicro is installed on the server. so do you mean that all users go by trendmicro and then to squid. So the latter thinks that the localhost is requesting the page...right? No other workaround? thx --- Henrik Nordstrom <henrik@xxxxxxxxxxxxxxxxxxx> wrote: > fre 2006-12-15 klockan 11:30 +0000 skrev Melanie > Pfefer: > > > but the third field is *always* the ip address of > the > > proxy itself. > > Using dansguardian? > > Regards > Henrik > Send instant messages to your online friends http://uk.messenger.yahoo.com