Can ELB send requests from two different IPs simultaneously?

Question

I use mod_rpaf to get the real IPs in the logs. However, it requires load balancers IP. Earlier, I used to see the "ELB-HealthChecker/1.0" useragent to get the ELB's IP. But, strangely today I can see two health check requests every time on each of the instances from two different IPs. My ELB and the EC2 instances are in same availability zone.

Anyone faced a similar situation? Is this an expected behavior or some anomaly?

Answer 1

It is normal to see a variety of ELB IP addresses. ELBs scale up and down with traffic to your site and those actions will cause you to see different IP addresses.

Using mod_rpaf with ELB is never going to be a reliable solution.

If you want to know the source IP that the ELB saw, then you can use use the last value from teh X-Forwarded-For list.

See also this blog post for a patch to mod_rpaf.