There appears to be a problem with the connection pinning in both versions squid-2.7.stable7 and squid-3.1.0.7. I have some network captures that show the client (IE6) creating multiple TCP connections to the squid proxy and the proxy creating multiple TCP connections to an IIS server. The initial couple of requests are OK but after that the input TCP connection to output TCP connect is broken. The requests are changing output bound TCP connections. This is breaking the NTLM authentication handshake. I can supply my squid configuration files if needed. I do have NTLM authentication enabled in both configurations. I have tcpdump traces for both versions available. In the 3.1 dump summary, note that the client packet 207 is the server packet 210. The server should be on port 37159 and it is on port 37161. Can a developer look at this? Jeff Foster jfoste@xxxxxxxxx Client No. Time Src Info 7 0.001648 1916 GET http://simon/efms/ HTTP/1.0 16 0.559067 1916 GET http://simon/efms/ HTTP/1.0, NTLMSSP_NEGOTIATE 21 0.752159 1916 GET http://simon/efms/ HTTP/1.0, NTLMSSP_AUTH, User: WG 42 1.576078 1917 GET http://simon/efms/ HTTP/1.0 65 1.961280 1917 GET http://simon/efms/ HTTP/1.0, NTLMSSP_NEGOTIATE 70 2.151384 1917 GET http://simon/efms/ HTTP/1.0, NTLMSSP_AUTH, User: WG 85 2.991803 1918 GET http://simon/EFMS/efms.js HTTP/1.0 144 3.370616 1918 GET http://simon/EFMS/efms.js HTTP/1.0, NTLMSSP_NEGOTIA 157 3.560971 1918 GET http://simon/EFMS/efms.js HTTP/1.0, NTLMSSP_AUTH, U 163 3.780493 1918 GET http://simon/EFMS/efms.css HTTP/1.0 171 3.781469 1919 GET http://simon/Styles/perry_fix_font.css HTTP/1.0 174 3.781643 1920 GET http://simon/Styles/forms.css HTTP/1.0 179 3.782358 1921 GET http://simon/styles/dashboard.css HTTP/1.0 195 3.969630 1918 GET http://simon/javascript/std.js HTTP/1.0 207 4.161036 1919 GET http://simon/EFMS/efms.css HTTP/1.0, NTLMSSP_NEGOTI 212 4.162125 1920 GET http://simon/Styles/perry_fix_font.css HTTP/1.0, NT 215 4.163060 1921 GET http://simon/styles/dashboard.css HTTP/1.0, NTLMSSP 217 4.163214 1918 GET http://simon/javascript/std.js HTTP/1.0, NTLMSSP_NE 225 4.359340 1919 GET http://simon/EFMS/efms.css HTTP/1.0, NTLMSSP_AUTH, 227 4.359685 1920 GET http://simon/Styles/perry_fix_font.css HTTP/1.0, NT 235 4.361623 1921 GET http://simon/styles/dashboard.css HTTP/1.0, NTLMSSP 237 4.362001 1918 GET http://simon/javascript/std.js HTTP/1.0, NTLMSSP_AU 243 4.577293 1919 GET http://simon/Styles/forms.css HTTP/1.0, NTLMSSP_NEG 257 4.768473 1920 GET http://simon/Styles/forms.css HTTP/1.0, NTLMSSP_AUT Squid Server No. Time Src Info 12 0.369931 37156 GET /efms/ HTTP/1.0 18 0.559496 37156 GET /efms/ HTTP/1.0, NTLMSSP_NEGOTIATE 23 0.752534 37156 GET /efms/ HTTP/1.0, NTLMSSP_AUTH, User: WGC\jfoste 61 1.758489 37157 GET /efms/ HTTP/1.0 67 1.961708 37157 GET /efms/ HTTP/1.0, NTLMSSP_NEGOTIATE 72 2.152100 37157 GET /efms/ HTTP/1.0, NTLMSSP_AUTH, User: WGC\jfoste 113 3.180079 37158 GET /EFMS/efms.js HTTP/1.0 146 3.371116 37158 GET /EFMS/efms.js HTTP/1.0, NTLMSSP_NEGOTIATE 159 3.561335 37158 GET /EFMS/efms.js HTTP/1.0, NTLMSSP_AUTH, User: WGC\jfo 168 3.781256 37158 GET /EFMS/efms.css HTTP/1.0 190 3.967221 37159 GET /Styles/perry_fix_font.css HTTP/1.0 191 3.967513 37160 GET /Styles/forms.css HTTP/1.0 192 3.967791 37161 GET /styles/dashboard.css HTTP/1.0 197 3.970336 37158 GET /javascript/std.js HTTP/1.0 210 4.161855 37161 GET /EFMS/efms.css HTTP/1.0, NTLMSSP_NEGOTIATE 214 4.162567 37160 GET /Styles/perry_fix_font.css HTTP/1.0, NTLMSSP_NEGOTI 219 4.163678 37159 GET /styles/dashboard.css HTTP/1.0, NTLMSSP_NEGOTIATE 220 4.163806 37158 GET /javascript/std.js HTTP/1.0, NTLMSSP_NEGOTIATE 231 4.360942 37160 GET /Styles/perry_fix_font.css HTTP/1.0, NTLMSSP_AUTH, 232 4.361087 37161 GET /EFMS/efms.css HTTP/1.0, NTLMSSP_AUTH, User: WGC\jf 239 4.362346 37159 GET /styles/dashboard.css HTTP/1.0, NTLMSSP_AUTH, User: 240 4.362591 37158 GET /javascript/std.js HTTP/1.0, NTLMSSP_AUTH, User: WG 245 4.577641 37161 GET /Styles/forms.css HTTP/1.0, NTLMSSP_NEGOTIATE 259 4.768829 37160 GET /Styles/forms.css HTTP/1.0, NTLMSSP_AUTH, User: WGC