Some even more strange access.log entries? This is odd? Does that mean no DNS record? strange as both squid's use the same DNS setup, with a primary, secondary and tertiary setup. 1269833940.167 0 127.0.0.1 NONE/400 1868 GET www.environment.gov.au - NONE/- text/html 1269833960.464 60997 10.132.17.30 TCP_MISS/000 0 GET http://www.environment.gov.au/ - DIRECT/155.187.3.81 - 1269834108.182 120002 127.0.0.1 TCP_MISS/000 0 GET http://www.environment.gov.au - DIRECT/155.187.3.81 - This one is new? 1269842635.028 295660 10.143.254.22 TCP_MISS/502 2514 GET http://www.environment.gov.au/ - DIRECT/155.187.3.81 text/html On Mon, Mar 29, 2010 at 4:56 PM, Ivan . <ivanhec@xxxxxxxxx> wrote: > Hi Amos > > You can see the tcp_miss in the access.log here:- > > 1269834108.182 120002 127.0.0.1 TCP_MISS/000 0 GET > http://www.environment.gov.au - DIRECT/155.187.3.81 - > > Here is a tcpdump output from the connection. You can see the TCP > handshake setup and then the http session just hangs? I have confirmed > with the website admin these are no ddos type protection, which would > block multiple requests in quick succession. > > The tcp connection times out and then resets. > > [root@squid-proxy ~]# tcpdump net 155.187.3 > tcpdump: verbose output suppressed, use -v or -vv for full protocol decode > listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes > 16:58:59.369482 IP xxx.xxxx.xxx.xxx.41338 > 155.187.3.81.http: S > 1781942738:1781942738(0) win 5840 <mss 1460,sackOK,timestamp > 1321171542 0,nop,wscale 7> > 16:58:59.418150 IP 155.187.3.81.http > xxx.xxxx.xxx.xxx.41338: S > 2343505326:2343505326(0) ack 1781942739 win 32768 <mss 1460,nop,wscale > 0,nop,nop,timestamp 234270252 1321171542,sackOK,eol> > 16:58:59.418167 IP xxx.xxxx.xxx.xxx.41338 > 155.187.3.81.http: . ack 1 > win 46 <nop,nop,timestamp 1321171591 234270252> > 16:58:59.418213 IP xxx.xxxx.xxx.xxx.41338 > 155.187.3.81.http: P > 1:696(695) ack 1 win 46 <nop,nop,timestamp 1321171591 234270252> > 16:58:59.477692 IP 155.187.3.81.http > xxx.xxxx.xxx.xxx.41338: P > 2897:4081(1184) ack 696 win 33304 <nop,nop,timestamp 234270307 > 1321171591> > 16:58:59.477700 IP xxx.xxxx.xxx.xxx.41338 > 155.187.3.81.http: . ack 1 > win 46 <nop,nop,timestamp 1321171650 234270252,nop,nop,sack 1 > {2897:4081}> > > > cheers > Ivan > > On Mon, Mar 29, 2010 at 3:59 PM, Amos Jeffries <squid3@xxxxxxxxxxxxx> wrote: >> Ivan . wrote: >>> >>> Hi, >>> >>> What would cause a TCP MISS 502, which would prevent a site from >>> loading? The site works on squidv3.0 but not on v2.6? >>> >> >> Any one of quite a few things. The ERR_READ_ERROR result means the remote >> server or network is closing the TCP link on you for some unknown reason. >> >> Why it works in 3.0 is as much a mystery as why it does not in 2.6 until >> details of the traffic on Squid->Server TCP link are known. >> >> >> Amos >> -- >> Please be using >> Current Stable Squid 2.7.STABLE8 or 3.0.STABLE25 >> Current Beta Squid 3.1.0.18 >> >
