Re: [SQU] source IP restriction problem

On Mon, 13 Nov 2000, Carl Li wrote:

]We want to establish a national wide cache mesh with Squid. But first we
]have to check if SQUID can be configured *TOTAL TRANSPARENCY* . That
]means neither the brower nor the web server know the existence of squid.

Usually, you can trick most proxies - there is no such thing as total
transparency, the reason WREC officially named them "interception
proxies". In a request, there might be up to three destination addresses:

a) the connect() address
b) the URL address (only 1.1 and up, or proxy requests)
c) the "Host:" header address

Often, by maliciously setting one or two of the addresses to a different
destination, you can detect an interception proxy based on the page
delivered and the server queried.

Ciao,
Dipl.-Ing. Jens-S. Vöckler (voeckler@rvs.uni-hannover.de)
Institute for Computer Networks and Distributed Systems (RVS)
University of Hanover, Germany; ++49 511 762 4726

--
To unsubscribe, see http://www.squid-cache.org/mailing-lists.html