collect remote ip at the beginning, code 499 for clinet closed connection