ipscrub icon indicating copy to clipboard operation
ipscrub copied to clipboard

Hash changes within `PERIOD`

Open lenzls opened this issue 3 years ago • 1 comments

Hello, I just installed ipscrub, and I'm seeing unexpected behaviour.

The screenshot shows the unscrubbed access.log on top and the scrubbed access_scrubbed.log below.

The hash of the IP 146.223.14.99 changes from ndjXjp to JEb+/G and back again within the same second. Looking at my access.log, this happens multiple times. Most requests from that IP have ndjXjp, but a few have JEb+/G as hashes.

We can also see that 66.69.106.150 has the hashes c5W8yh and Tz0Hqw. scrot_2022-12-15_19-38-54_screenshot

Is this somehow expected behaviour?

I expected the same IP always transforms into the exact same hash within a PERIOD.

I'm on nginx/1.22.1 and compiled ipscrub as a dynamic module.

Kind regards

lenzls avatar Dec 15 '22 18:12 lenzls