Re: [squid-users] squid cache poisoing

On Thu, 18 Dec 2003, vikram mohite wrote:

> To understand the problem we removed IPTABLES rules, cleared the cache again
> and put ethereal on client machine. When the problem reoccured we captured
> the entire TCP stream. We again cleared the cache and opened the page
> captured which immediatly reproduced the problem. The problem was also
> reproduced on all other client machines accessing the proxy .

Can you please get a ethereal or tcpdump -s 1600 trace of the poisoning
traffic on the Squid proxy?

   tcpdump -s 1600 -w traffic.dump -i any

The trace should include

   1. The requests which was identified as causing the cache poisoning

   2. One request showing that the cache is poisoned.

> Strangly I have not been able to reproduce the problem on any other squid
> proxy running same versions of squid ( diff hardware config but same
> squid.conf )

Odd..

and there is no difference in network connectivity? Including which DNS
servers are used, ISP etc..

Regards
Henrik
Received on Thu Dec 18 2003 - 05:33:04 MST