Re: [squid-users] TCP_MISS/200 in logfile!

On Wednesday 10 September 2003 11.18, Nauman Malik wrote:
> I have lots of TCP_MISS/504 in log files. It slows down my proxy as
> well. Any idea?.
>
>
> 1063160536.044 509082 202.15.52.45 TCP_MISS/504 1021 GET
> http://202.100.131.202/ - NONE/- - 1063160536.044 509617
> 202.15.52.45 TCP_MISS/504 1021 GET http://202.100.132.189/ - NONE/-
> - 1063160537.027 509295 202.15.52.45 TCP_MISS/504 1019 GET
> http://202.100.132.28/ - NONE/- - 1063160537.027 509535
> 202.15.52.45 TCP_MISS/504 1019 GET http://202.100.132.30/ - NONE/-
> - 1063160537.027 509325 202.15.52.45 TCP_MISS/504 1021 GET
> http://202.100.131.200/ - NONE/- - 1063160537.027 419656
> 202.15.52.45 TCP_MISS/504 1021 GET http://202.100.160.153/ - NONE/-
> - 1063160539.014 509486 202.15.52.45 TCP_MISS/504 1021 GET
> http://202.100.132.238/ - NONE/- - 1063160539.014 509342
> 202.15.52.45 TCP_MISS/504 1021 GET http://202.100.133.206/ - NONE/-
> -

Most likely the client with IP 202.15.52.45 is infected by a
virus/worm trying to propagate itself to random IIS servers on the
net or otherwise scanning the network for HTTP servers via your
proxy.

Regards
Henrik

-- 
Donations welcome if you consider my Free Squid support helpful.
https://www.paypal.com/xclick/business=hno%40squid-cache.org
If you need commercial Squid support or cost effective Squid or
firewall appliances please refer to MARA Systems AB, Sweden
http://www.marasystems.com/, info@marasystems.com