Actually, I didn't see this at first, but it looks like the issue is with the squidguard. I realize this is not squidguard forum, but if you know a way to solve this I would appreciate it. 2011-12-13 20:38:22 [3699] WARN: Possible bypass attempt. Found multiple slashes where only one is expected: http://rb.newsru.com//cgi-bin/banner/148?21490&login=echo_214x92&referer=http://www.echo.msk.ru/ 2011-12-13 20:38:23 [3699] WARN: Possible bypass attempt. Found multiple slashes where only one is expected: http://rb.newsru.com//cgi-bin/banner/48?795035&login=echo_214x92-1&referer=http://www.echo.msk.ru/ 2011-12-13 20:38:27 [3699] WARN: Possible bypass attempt. Found multiple slashes where only one is expected: http://234.adru.net//cgi-bin/banner/926?52490&login=echomsk234&referer=http://www.echo.msk.ru/ 2011-12-13 20:38:27 [3699] WARN: Possible bypass attempt. Found multiple slashes where only one is expected: http://234.adru.net//cgi-bin/banner/2031?215045&login=echomsk234-1&referer=http://www.echo.msk.ru/ 2011-12-13 20:38:28 [3699] WARN: Possible bypass attempt. Found multiple slashes where only one is expected: http://sj1.ru//cgi-bin/banner/492?777&login=echo&referer=http://www.echo.msk.ru/ 2011-12-13 20:38:31 [3699] WARN: Possible bypass attempt. Found multiple slashes where only one is expected: http://rb.newsru.com//cgi-bin/banner/148?21490&login=echo_214x92&referer=http://www.echo.msk.ru/blog/video/838893-echo/ 2011-12-13 20:38:33 [3699] WARN: Possible bypass attempt. Found multiple slashes where only one is expected: http://rb.newsru.com//cgi-bin/banner/48?795035&login=echo_214x92-1&referer=http://www.echo.msk.ru/blog/video/838893-echo/ 2011-12-13 20:38:34 [3699] WARN: Possible bypass attempt. Found multiple slashes where only one is expected: http://234.adru.net//cgi-bin/banner/2031?215045&login=echomsk234-1&referer=http://www.echo.msk.ru/blog/video/838893-echo/ 2011-12-13 20:38:34 [3699] WARN: Possible bypass attempt. Found multiple slashes where only one is expected: http://234.adru.net//cgi-bin/banner/2109?52490&login=echomsk234&referer=http://www.echo.msk.ru/blog/video/838893-echo/ 2011-12-13 20:38:35 [3699] WARN: Possible bypass attempt. Found multiple slashes where only one is expected: http://sj1.ru//cgi-bin/banner/460?777&login=echo&referer=http://www.echo.msk.ru/blog/video/838893-echo/ 2011-12-13 20:39:14 [3699] WARN: Possible bypass attempt. Found multiple slashes where only one is expected: http://rb.newsru.com//cgi-bin/banner/148?21490&login=echo_214x92&referer=http://www.echo.msk.ru/blog/video/838893-echo/ 2011-12-13 20:39:23 [3699] WARN: Possible bypass attempt. Found multiple slashes where only one is expected: http://rb.newsru.com//cgi-bin/banner/148?21490&login=echo_214x92&referer=http://www.echo.msk.ru/blog/video/838893-echo/ 2011-12-13 20:39:35 [3699] WARN: Possible bypass attempt. Found multiple slashes where only one is expected: http://234.adru.net//cgi-bin/banner/510?52490&login=echomsk234&referer=http://www.echo.msk.ru/blog/video/838893-echo/ 2011-12-13 20:39:35 [3699] WARN: Possible bypass attempt. Found multiple slashes where only one is expected: http://sj1.ru//cgi-bin/banner/492?777&login=echo&referer=http://www.echo.msk.ru/blog/video/838893-echo/ 2011-12-13 20:39:36 [3699] WARN: Possible bypass attempt. Found multiple slashes where only one is expected: http://234.adru.net//cgi-bin/banner/2031?215045&login=echomsk234-1&referer=http://www.echo.msk.ru/blog/video/838893-echo/ On Tue, Dec 13, 2011 at 6:21 PM, Amos Jeffries <squid3@xxxxxxxxxxxxx> wrote: > On Tue, 13 Dec 2011 16:49:02 -0500, Roman Gelfand wrote: >> >> Video streaming on this site >> http://www.echo.msk.ru/blog/video/838893-echo/ not working. I am not >> sure if it has anything to do with it, but I am using ssl bump. >> >> The squid version is 3.1.16. Squidclamav version is 6.4. c-icap >> version is 0.1.7 >> >> 1323811211.100 369 192.168.3.210 TCP_MISS/304 286 GET >> http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl - >> DIRECT/96.17.10.72 application/pkix-crl >> 1323811211.210 102 192.168.3.210 TCP_MISS/304 285 GET >> http://crl.microsoft.com/pki/crl/products/CSPCA.crl - >> DIRECT/96.17.10.72 application/pkix-crl >> 1323811211.334 116 192.168.3.210 TCP_MISS/304 286 GET >> http://crl.microsoft.com/pki/crl/products/CodeSigPCA.crl - >> DIRECT/96.17.10.72 application/pkix-crl >> 1323811211.757 415 192.168.3.210 TCP_MISS/304 235 GET >> >> >> http://mscrl.microsoft.com/pki/mscorp/crl/Microsoft%20Secure%20Server%20Authority(8).crl >> - DIRECT/70.37.128.164 application/pkix-crl >> 1323811211.820 55 192.168.3.210 TCP_MISS/304 235 GET >> http://mscrl.microsoft.com/pki/mscorp/crl/mswww(5).crl - >> DIRECT/70.37.128.164 application/pkix-crl >> 1323811321.159 988 192.168.3.210 TCP_MISS/200 2567 GET >> http://img2.imgsmail.ru/r/my/app/flash_lc.swf - DIRECT/94.100.187.36 >> application/x-shockwave-flash > > > Notice how the log contains *no* HTTP errors of any kind. In fact how > "echo.msk.ru" does not occur in it at all. > > Do you have any more details about the problem? > > Amos
