Henrik Nordstrom wrote: > On Wed, 23 Feb 2005, Jesse Guardiani wrote: > >> OK. It's blocking the traffic now. I try to access a page on the >> client and the browser just spins. I'm not seeing any new entries >> in my squid access log, but the counters in iptables are incrementing >> as shown above. >> >> My guess is that since the squid box is on the same subnet as the >> client box, the cisco is looping port 80 traffic from the squid >> back to the squid. Does that sound possible? Again, I'm not seeing >> anything in access.log though. What do you think? > > tcpdump is your friend in diagnosing problems on this level. OK. This is my first time using tcpdump. I think I've narrowed it down to the interesting part. "shannon" is the box I'm SSH'ing into the squid server, 192.168.10.2, from. 192.168.1.193 is a machine on the network that "rhea" happens to be talking to because I run distcc and I'm compiling things as I test. I didn't think the syslog, domain, or distcc (3632) ports look interesting. That said, here's my tcpdump command: tcpdump 'not ( host shannon and port 22 ) and not host 192.168.1.193 and not port syslog and not port domain and not snmp and not port 3632' And here's the only thing I could find that looked relevent: 04:22:30.959889 IP 192.168.10.2.2048 > 192.168.10.1.2048: UDP, length: 120 04:22:30.961323 IP 192.168.10.1.2048 > 192.168.10.2.2048: UDP, length: 140 04:22:32.791481 IP 192.168.10.1 > 192.168.10.2: gre-proto-0x883e 04:22:35.790420 IP 192.168.10.1 > 192.168.10.2: gre-proto-0x883e 04:22:40.954870 IP 192.168.10.2.2048 > 192.168.10.1.2048: UDP, length: 120 04:22:40.956378 IP 192.168.10.1.2048 > 192.168.10.2.2048: UDP, length: 140 04:22:41.790316 IP 192.168.10.1 > 192.168.10.2: gre-proto-0x883e 04:22:51.932636 IP 192.168.10.2.2048 > 192.168.10.1.2048: UDP, length: 120 04:22:51.934544 IP 192.168.10.1.2048 > 192.168.10.2.2048: UDP, length: 140 192.168.10.1 is my Cisco router's LAN address. Does the above mean anything to anyone? Thanks! -- Jesse Guardiani, Systems Administrator WingNET Internet Services, P.O. Box 2605 // Cleveland, TN 37320-2605 423-559-LINK (v) 423-559-5145 (f) http://www.wingnet.net
