Re: [squid-users] TCP MISS 502

Some even more strange access.log entries?

This is odd? Does that mean no DNS record? strange as both squid's use
the same DNS setup, with a primary, secondary and tertiary setup.
1269833940.167 0 127.0.0.1 NONE/400 1868 GET
www.environment.gov.au - NONE/- text/html

1269833960.464 60997 10.132.17.30 TCP_MISS/000 0 GET
http://www.environment.gov.au/ - DIRECT/155.187.3.81 -

1269834108.182 120002 127.0.0.1 TCP_MISS/000 0 GET
http://www.environment.gov.au - DIRECT/155.187.3.81 -

This one is new?
1269842635.028 295660 10.143.254.22 TCP_MISS/502 2514 GET
http://www.environment.gov.au/ - DIRECT/155.187.3.81 text/html

On Mon, Mar 29, 2010 at 4:56 PM, Ivan . <ivanhec_at_gmail.com> wrote:
> Hi Amos
>
> You can see the tcp_miss in the access.log here:-
>
> 1269834108.182 120002 127.0.0.1 TCP_MISS/000 0 GET
> http://www.environment.gov.au - DIRECT/155.187.3.81 -
>
> Here is a tcpdump output from the connection. You can see the TCP
> handshake setup and then the http session just hangs? I have confirmed
> with the website admin these are no ddos type protection, which would
> block multiple requests in quick succession.
>
> The tcp connection times out and then resets.
>
> [root_at_squid-proxy ~]# tcpdump net 155.187.3
> tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
> listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
> 16:58:59.369482 IP xxx.xxxx.xxx.xxx.41338 > 155.187.3.81.http: S
> 1781942738:1781942738(0) win 5840 <mss 1460,sackOK,timestamp
> 1321171542 0,nop,wscale 7>
> 16:58:59.418150 IP 155.187.3.81.http > xxx.xxxx.xxx.xxx.41338: S
> 2343505326:2343505326(0) ack 1781942739 win 32768 <mss 1460,nop,wscale
> 0,nop,nop,timestamp 234270252 1321171542,sackOK,eol>
> 16:58:59.418167 IP xxx.xxxx.xxx.xxx.41338 > 155.187.3.81.http: . ack 1
> win 46 <nop,nop,timestamp 1321171591 234270252>
> 16:58:59.418213 IP xxx.xxxx.xxx.xxx.41338 > 155.187.3.81.http: P
> 1:696(695) ack 1 win 46 <nop,nop,timestamp 1321171591 234270252>
> 16:58:59.477692 IP 155.187.3.81.http > xxx.xxxx.xxx.xxx.41338: P
> 2897:4081(1184) ack 696 win 33304 <nop,nop,timestamp 234270307
> 1321171591>
> 16:58:59.477700 IP xxx.xxxx.xxx.xxx.41338 > 155.187.3.81.http: . ack 1
> win 46 <nop,nop,timestamp 1321171650 234270252,nop,nop,sack 1
> {2897:4081}>
>
>
> cheers
> Ivan
>
> On Mon, Mar 29, 2010 at 3:59 PM, Amos Jeffries <squid3_at_treenet.co.nz> wrote:
>> Ivan . wrote:
>>>
>>> Hi,
>>>
>>> What would cause a TCP MISS 502, which would prevent a site from
>>> loading? The site works on squidv3.0 but not on v2.6?
>>>
>>
>> Any one of quite a few things. The ERR_READ_ERROR result means the remote
>> server or network is closing the TCP link on you for some unknown reason.
>>
>> Why it works in 3.0 is as much a mystery as why it does not in 2.6 until
>> details of the traffic on Squid->Server TCP link are known.
>>
>>
>> Amos
>> --
>> Please be using
>>  Current Stable Squid 2.7.STABLE8 or 3.0.STABLE25
>>  Current Beta Squid 3.1.0.18
>>
>
Received on Mon Mar 29 2010 - 06:20:43 MDT