Re: NULL characters in Header - how to get which sites generate this?

[Amos Jeffries <squid3@xxxxxxxxxxxxx>]

On 14/09/2012 12:14 a.m., x-man wrote:
> Hi,
>
> my cache.log file is full of this kind of messages:
>
> Content-Type: application/x-www-form-urlencoded
> 2012/09/13 17:39:35| WARNING: HTTP header contains NULL characters {Accept:
> */*
> Content-Type: application/x-www-form-urlencoded}
> NULL
> {Accept: */*
> Content-Type: application/x-www-form-urlencoded
> 2012/09/13 17:39:35| WARNING: HTTP header contains NULL characters {Accept:
> */*
> Content-Type: application/x-www-form-urlencoded}
> NULL
> {Accept: */*
> Content-Type: application/x-www-form-urlencoded
>
> How to find out which site/sites are generating this, so I can bypass
> them...
>
> I'm running squid 3.1.20 as transparent tproxy for many users.

Unfortunately with 3.1 your best hope is a tcpdump trace.

Amos