Re: [squid-users] strange requests

----- Original Message -----
From: "Joe Cooper" <joe@swelltech.com>
To: "Henrik Nordstrom" <hno@squid-cache.org>
Cc: "Hilal Afridi" <afridi@iqranet.info>; <squid-users@squid-cache.org>
Sent: Thursday, April 29, 2004 4:05 AM
Subject: Re: [squid-users] strange requests

> Henrik Nordstrom wrote:
> > On Thu, 29 Apr 2004, Hilal Afridi wrote:
> >
> >
> >>Joe i still have not been able to take care of those TCP/MISS 000
requests.
> >>I have been trying to post this question to the list by lord knows why
it
> >>aint getting there.
> >
> >
> > This question got to the list.
> >
> > What TCP_MISS/000 problem is you having?
> >
> > Btw, TCP_MISS/000 indicates there was no reply to this request before
the
> > client aborted the connection.
>
> I believe it is the same problem that I just discussed with Jason McNeil
> this afternoon. Requests generated by a virus that leads to extremely
> heavy file descriptor and CPU usage. The workaround (which only
> partially solves the problem, but solves it well enough to prevent DoS
> of the Squid process) I've been using is to turn off half_closed_clients.
>
> However, Hilal replied further that his Squid already had this option
> turned off and it didn't help. It may be that he has a larger infected
> population than I've seen, or it may be a different issue entirely.

I have same problem over here. I have about 2000 hosts and a good number
of them are infected by virus/worms. Even after turning off
half_closed_clients,
squid slows down significiantly. The average service time which used to be
30-40 ms, will range new 100-300ms.

I am planning to block the port 80 for these clients in our multilayer
switch
instead of transparently redirecting them to cache and force them to
configure the
proxy manually.

Any other solutions for this problem?

Venkatesh K
Received on Wed Apr 28 2004 - 18:42:04 MDT