RE: [squid-users] Strange source-IP-addresses in access.log - ADD ITIONAL INFO

# -----Original Message-----
# From: Adrian Chadd [mailto:adrian@squid-cache.org]
# Sent: Thursday, 07 March 2002 10:43
# To: Boosten, Peter
# Subject: Re: [squid-users] Strange source-IP-addresses in access.log -
# ADD ITIONAL INFO
[snip]
# >
#
# Hi,
#
# It smells like spyware of sorts. It won't be a squid-related issue.
# Squid will (correctly) downgrade the request from 1.1 to 1.0 when
# it issues the request to an origin server, and IE handles
# (thank god :) the HTTP/1.0 reply correctly.
#

Thnx for your answer.

But how does Squid log the incorrect Client-IP-address? Where does it come
from?

We've done a tcpdump on the proxyserver and found the IP-headers (source-IP)
to be correct.
Because of the massive volume, we limited the collected data to 20 bytes,
but since we know that it concerns specific sites, we can filter more
detailed info, to search for the IP-address (maybe in hex-format).

Peter

Disclaimer
1. This e-mail is for the intended recipient only. If you have received it
by mistake please let us know by reply and then delete it from your system;
access, disclosure, copying, distribution or reliance on any of it by anyone
else is prohibited.

2. If you as intended recipient have received this e-mail incorrectly,
please notify the sender (via e-mail) immediately. This e-mail is
confidential and may be legally privileged. DSM does not guarantee that the
information sent and/or received by or with this e-mail is correct and does
not accept any liability for damages related thereto.
Received on Thu Mar 07 2002 - 03:54:25 MST