Re: [squid-users] strange problem in squid with certain sites and strange log

On 6/07/2012 6:25 a.m., x-man wrote:
> Hello,
>
> I'm running squid 3.1.19 in tproxy mode, and I have some customers
> complaining that they have problem with stock exchange (share market) sites
> and software after implementing the squid. What I saw in the access.log for
> one of the customers is:
>
> 10.21.8.59 - - [04/Jul/2012:12:01:56 +0530] "GET
> http://login.angeltrade.com/AngeltradeDiet/DietOdinSingleInterface.asp?
> HTTP/1.1" 200 3557 TCP_MISS:DIRECT
> 10.21.8.59 - - [04/Jul/2012:12:01:57 +0530] "NONE error:invalid-request
> HTTP/0.0" 400 4021 NONE:NONE
> <snip>
> 10.21.8.59 - - [04/Jul/2012:12:02:11 +0530] "NONE error:invalid-request
> HTTP/0.0" 400 4021 NONE:NONE
> 10.21.8.59 - - [04/Jul/2012:12:02:12 +0530] "NONE error:invalid-request
> HTTP/0.0" 400 4021 NONE:NONE
>
> What would this mean?

Something that is not HTTP was sent over port-80 by the client.

>
> What can I do to further investigate the case and probably resolve it...

"tcpdump -s 0" will give you a packet trace you can analyse and see what
the client is doing.

Amos
Received on Fri Jul 06 2012 - 07:08:14 MDT