While diagnosing an unrelated network problem, I ran tcpdump on my Squid (2.5-STABLE3) box. I found the following pattern repeating several times per second. I don't know how long this has been going on, but at least several days. If I kill Squid, it stops. x.x.x.99 = DMZ network port on Squid system x.x.x.20 = Web server (IIS) on my DMZ 08:02:14.092144 x.x.x.20.https > x.x.x.99.42362: P 1759:1805(46) ack 1797 win 64233 <nop,nop,timestamp 663266 2095770651> (DF) 08:02:14.092186 x.x.x.99.42362 > x.x.x.20.https: . ack 1805 win 63712 <nop,nop,timestamp 2095770651 663266> (DF) 08:02:14.092351 x.x.x.20.https > x.x.x.99.42359: P 850:896(46) ack 795 win 64233 <nop,nop,timestamp 663266 2095770651> (DF) 08:02:14.092376 x.x.x.99.42359 > x.x.x.20.https: . ack 896 win 63712 <nop,nop,timestamp 2095770651 663266> (DF) 08:02:14.259571 x.x.x.99.42362 > x.x.x.20.https: P 1797:2005(208) ack 1805 win 63712 <nop,nop,timestamp 2095770668 663266> (DF) 08:02:14.259862 x.x.x.99.42359 > x.x.x.20.https: P 795:1017(222) ack 896 win 63712 <nop,nop,timestamp 2095770668 663266> (DF) 08:02:14.260994 x.x.x.20.https > x.x.x.99.42362: P 1805:2220(415) ack 2005 win 65535 <nop,nop,timestamp 663269 2095770668> (DF) 08:02:14.261031 x.x.x.99.42362 > x.x.x.20.https: . ack 2220 win 63712 <nop,nop,timestamp 2095770668 663269> (DF) 08:02:14.450432 x.x.x.20.https > x.x.x.99.42359: . ack 1017 win 65535 <nop,nop,timestamp 663271 2095770668> (DF) 08:02:14.450868 x.x.x.20.https > x.x.x.99.42359: P 896:1298(402) ack 1017 win 65535 <nop,nop,timestamp 663271 2095770668> (DF) 08:02:14.450890 x.x.x.99.42359 > x.x.x.20.https: . ack 1298 win 63712 <nop,nop,timestamp 2095770687 663271> (DF) 08:02:14.581353 x.x.x.99.42362 > x.x.x.20.https: P 2005:2291(286) ack 2220 win 63712 <nop,nop,timestamp 2095770700 663269> (DF) 08:02:14.581737 x.x.x.20.https > x.x.x.99.42362: P 2220:2266(46) ack 2291 win 65249 <nop,nop,timestamp 663272 2095770700> (DF) 08:02:14.581778 x.x.x.99.42362 > x.x.x.20.https: . ack 2266 win 63712 <nop,nop,timestamp 2095770700 663272> (DF) 08:02:14.755502 x.x.x.99.42362 > x.x.x.20.https: P 2291:2513(222) ack 2266 win 63712 <nop,nop,timestamp 2095770717 663272> (DF) 08:02:14.755917 x.x.x.99.42359 > x.x.x.20.https: P 1017:1303(286) ack 1298 win 63712 <nop,nop,timestamp 2095770718 663271> (DF) 08:02:14.756272 x.x.x.20.https > x.x.x.99.42359: P 1298:1344(46) ack 1303 win 65249 <nop,nop,timestamp 663273 2095770718> (DF) 08:02:14.756315 x.x.x.99.42359 > x.x.x.20.https: . ack 1344 win 63712 <nop,nop,timestamp 2095770718 663273> (DF) 08:02:14.887740 x.x.x.20.https > x.x.x.99.42362: . ack 2513 win 65027 <nop,nop,timestamp 663275 2095770717> (DF) I have the following in squid.conf: acl Local dst x.x.x.0/24 no_cache deny Local It appears Squid is trying to access something on the web server, but I don't know why. There is only very occasional traffic in access.log for x.x.x.20. Any ideas would be most appreciated. Alan Lehman
