tis 2007-06-12 klockan 11:21 +0500 skrev rihad: > Our Squid has long been constantly putting some strange lines in cache.log: > > 2007/06/12 11:15:45| parseHttpRequest: Requestheader contains NULL > characters > 2007/06/12 11:15:45| parseHttpRequest: Unsupported method '^C' > 2007/06/12 11:15:45| clientReadRequest: FD 930 (x.x.x.x:2649) Invalid > Request > 2007/06/12 11:15:45| parseHttpRequest: Requestheader contains NULL > characters > 2007/06/12 11:15:45| parseHttpRequest: Unsupported method '^C' > 2007/06/12 11:15:45| clientReadRequest: FD 145 (x.x.x.x:62332) Invalid > Request > 2007/06/12 11:15:48| parseHttpRequest: Requestheader contains NULL > characters > 2007/06/12 11:15:48| parseHttpRequest: Unsupported method '^C' > 2007/06/12 11:15:48| clientReadRequest: FD 1611 (x.x.x.x:60853) Invalid > Request > 2007/06/12 11:15:49| parseHttpRequest: Requestheader contains NULL > characters > 2007/06/12 11:15:49| parseHttpRequest: Unsupported method '^C' > > > ad nauseum (the IP addresses need not be the same) at a rate of 30-40 > megs a day. Does someone know what the reason could be, even if it's > unrelated to Squid (I'm not sure)? Thanks. Please use ethereal/wireshark to capture one or two of these. 1. Start wireshart, and start a new packet capture. 2. When seeing the error in cache.log, enter the filter ip.address == YYYYYY && tcp.port == XXXXX where YYYYY is the IP and XXXXX is the port number from the Invalid Request log line. Then select the first packet shown (should be a SYN), and choose Analyze -> Follow TCP Stream. This opens a new window with the TCP stream decoded. What do you get? Regards Henrik
Attachment:
signature.asc
Description: Detta =?ISO-8859-1?Q?=E4r?= en digitalt signerad meddelandedel
