[squid-users] Re: Squid floods and kills router

> Never seen Squid cause anything like this before in the 7
> years I have been working with Squid.

Maybe its because SquidNT on Windows box.

> What does the packets look like?

I have attached one captured frame to nmy first message.

> source/destination
> source/destination ports

Source - Windows 2000 Server running SquidNT @port 60000

Destination - client (Windows 2000, IE6) requesting web page - @port 1499.
I see a few more ports like 1505, but it is completely strange - I think,
that with each new connection port number should increase?

> a single TCP stream, or many TCP streams?

Router is killed by single large TCP stream from Squid. before that, Squid
provides a few pages normally, router passes them and then just crashes.

> window sizes

I don't know that you mean, but I am attaching captured frame once again.

----------------------------------------------------------------------------
--------------

Frame 24469 (60 bytes on wire, 60 bytes captured)
    Arrival Time: Jun 19, 2003 21:54:16.627708000
    Time delta from previous packet: 0.000119000 seconds
    Time relative to first packet: 6690.059331000 seconds
    Frame Number: 24469
    Packet Length: 60 bytes
    Capture Length: 60 bytes
Ethernet II, Src: 00:30:4f:05:c3:b4, Dst: 00:c0:ca:16:2c:69
    Destination: 00:c0:ca:16:2c:69 (meistras.xxx.com)
    Source: 00:30:4f:05:c3:b4 (192.168.0.2)
    Type: IP (0x0800)
    Trailer: 2020202020
Internet Protocol, Src Addr: terminalas.xxx.com (192.168.0.2), Dst Addr:
meistras.xxx.com (192.168.0.210)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 41
    Identification: 0x3b82 (15234)
    Flags: 0x04
        .1.. = Don't fragment: Set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: TCP (0x06)
    Header checksum: 0x3d28 (correct)
    Source: terminalas.xxx.com (192.168.0.2)
    Destination: meistras.xxx.com (192.168.0.210)
Transmission Control Protocol, Src Port: 60000 (60000), Dst Port: 1499
(1499), Seq: 2825473810, Ack: 3096049156, Len: 1
    Source port: 60000 (60000)
    Destination port: 1499 (1499)
    Sequence number: 2825473810
    Next sequence number: 2825473811
    Acknowledgement number: 3096049156
    Header length: 20 bytes
    Flags: 0x0018 (PSH, ACK)
        0... .... = Congestion Window Reduced (CWR): Not set
        .0.. .... = ECN-Echo: Not set
        ..0. .... = Urgent: Not set
        ...1 .... = Acknowledgment: Set
        .... 1... = Push: Set
        .... .0.. = Reset: Not set
        .... ..0. = Syn: Not set
        .... ...0 = Fin: Not set
    Window size: 63234
    Checksum: 0x3b5d (correct)
Data (1 byte)

0000 65 e
Received on Thu Jun 19 2003 - 23:25:17 MDT