On 6/07/2012 6:25 a.m., x-man wrote:
Hello, I'm running squid 3.1.19 in tproxy mode, and I have some customers complaining that they have problem with stock exchange (share market) sites and software after implementing the squid. What I saw in the access.log for one of the customers is: 10.21.8.59 - - [04/Jul/2012:12:01:56 +0530] "GET http://login.angeltrade.com/AngeltradeDiet/DietOdinSingleInterface.asp? HTTP/1.1" 200 3557 TCP_MISS:DIRECT 10.21.8.59 - - [04/Jul/2012:12:01:57 +0530] "NONE error:invalid-request HTTP/0.0" 400 4021 NONE:NONE <snip> 10.21.8.59 - - [04/Jul/2012:12:02:11 +0530] "NONE error:invalid-request HTTP/0.0" 400 4021 NONE:NONE 10.21.8.59 - - [04/Jul/2012:12:02:12 +0530] "NONE error:invalid-request HTTP/0.0" 400 4021 NONE:NONE What would this mean?
Something that is not HTTP was sent over port-80 by the client.
What can I do to further investigate the case and probably resolve it...
"tcpdump -s 0" will give you a packet trace you can analyse and see what the client is doing.
Amos
