Automatically detecting whether sessions are routed through proxy servers is provided. The system identifies a log with session information generated by a device for a session established between a client and a server traversing the device. The system compares a source internet protocol (“IP”) address for the session identified from the log with IP addresses of proxy servers. The system updates, responsive to a match based on the comparison, the log with an indication that the session was routed through a proxy server.