[squid-users] alot of strange requests comming from child proxy

From: Gregory Machin <gdm_at_linuxpro.co.za>
Date: Fri, 22 Aug 2008 10:49:53 +0200

I have a client that we provide conectivity for. they have a fire will
running a squid proxy that is configured with our proxy as it's parent
proxy and most of the traffic I'm seeing looks like this

1219394376.025 119836 192.168.199.253 TCP_MISS/000 0 GET
http://192.168.200.10/secars/secars.dll?h=BDA3879CF852B95325CD75608CD49315436E38A1B858309C419143C4240C16B00CB181C599C323EF8D893FA74D9B19FF36B489B0B0C1035F8206A3AB6DF27E36FBA34062AE1AE4E6980A04003009E371E49453B5E0D62BC333D1B882580717AFEFCB725D0F0257C6C0F1D1B477B03BA82F0A6B2271256AAAD3807B5AEAD42274A3B23C0E045C51B7E61D5775D0F97BEAD0430165964F5F4A31DEBCC8F9DF1669C2DD64C791538CEB227CB9612ED2660F8AF3D9E7F77B509FF3F6BC9421F039ED7B47C559076B49E8B1884821FE0920B777EE7A27F384B0B82F99478A56FB5EDA7AFB10AAEAB2B70A94671358A63C5EDEE287BB7256ABA297402B7A9DD8375195D5CFCA9B67B1FA0AA253AB4DD45B9CDC03788336BBD9DB028559F1A33F8C9EB2CC40A44D7F1B8B1369F08B61EC355F176E5D283F5D8B6B07F9FBB3B8C0E93DF21E677ECC878284133CE2E6283A9560AD1A91690FCBD075867B916926EE9BDC744D62F9F2A1FC2683AA97882D595FA830AF9AF483040F0EE80F99E34F4F158B3DD670B89FE39FC3822032F819B0D4A559321E12D54D5DD7ABEE09725578A7FA1D682CADEA93A98E44F62D284566463F32
- DIRECT/192.168.200.10 -
1219394376.112 119812 192.168.199.253 TCP_MISS/000 0 GET
http://192.168.201.143/secars/secars.dll?h=6C16C7F7CB8552608F100CA8B11F626AEC4B4A1F8925D5E0B4FE5434FEC16DEE329F29B39AA3A9685FA0FC904838EFA3C17ABA5D1A93EE6AF9DE0C6502FEE3D03CE77A1F2D64703660F9155B65BD9449D4985F0C6F66EE924F314CD8E01C2E7D25314888DAAC08294F0241DFFB2646827D4C249A6C9358D79FA51D4E4D117752F96DB435B9613368DFBB94622FA64AD7B135E9FAF62828A870BACAFDD2D7131E1F9EAD313528FCC6D725877013AF93A8493466CD5229DFD128D4E059D36844F367F8D37328E3E642618B382E791227DFFC70360A9A349E217F822E72A2B5E65574397D1EB8C7BBD69B3E3AAE4A7A67BEB1A4D4E98A229671F8E752F397D685F5E14E2B596E683AC565B227C4272F10786543DE6F6F9E71902F0BC3175E2AE663708E71FB304C2AFB5E97852AA43E03843837D4B1D0A39289BD371D135C68ACA90040A3F117C97BD7CC2D837D8121C410A1DD633B6DA05D57191AF6147EFC87CC051D3DCC49CFC099CE4197CD83B583C7
- DIRECT/192.168.201.143 -
1219394376.313 119792 192.168.199.253 TCP_MISS/000 0 GET
http://192.168.200.10/secars/secars.dll?h=8A4F1743217F213893940A066FA0327A70013D90ADCFFAA63D79E536816A8D6954969B4CD1504F360A7186CE6C7ABBAAAE38944D2ADC272600A263B849B99EB8718A2F72F491BE9313E232C715A6D554014389799E4095D5F7B4B3B25668337891F2BDA12D30F9C7B388132354AFB497965315DED9345938C5A265F307A9D2412116A795987AEDA39E92AB4234359D857876663CE5B5CC14B97BAC7BAF138D6F6A427C74BA0AF2741379F0897C27BABC40417C5651E8EE8E5BFF57E2F3A9AC96C62DEB85BB528E48599705A1FAC16914B2B209058C3EF7709B1E21F32AE4F476ED25B3290C433D01208844E41F5027AFE287BB7256ABA297402B7A9DD8375195D5CFCA9B67B1FA0AA253AB4DD45B9CDC03788336BBD9DB028559F1A33F8C9EB280E54DD44843B0ADF5ED98992B3308B455A96EE2C15924C1AB1D75B42E6CAE64DD1D7574ED8CA99617961917E51323A68B7910134E6CABFA446BA9D277ED9722D6B86D0672BDCE22CEFC58139078B44B190BA8A72E65067772B61F1876A5EEA1321E12D54D5DD7ABEE09725578A7FA1D682CADEA93A98E44F62D284566463F32
- DIRECT/192.168.200.10 -

what is it ? and should I my proxy be receiving these requests ?

Thanks
Received on Fri Aug 22 2008 - 08:49:56 MDT

This archive was generated by hypermail 2.2.0 : Fri Aug 22 2008 - 12:00:03 MDT