On 5/05/2014 6:31 p.m., 0bj3ct wrote: > Amos Jeffries-2 wrote >> 1399271119.105 05/May/2014:11:25:19 +0500 100 84:3w:28:49:b9:e5 >> 10.x.x.x TCP_MISS/200 10613 GET http://www.oracle.com/favicon.ico - >> HIER_DIRECT/23.64.230.140 image/x-icon >> 1399271131.094 05/May/2014:11:25:31 +0500 5012 84:3w:28:49:b9:e5 >> 10.x.x.x TCP_MISS_ABORTED/000 0 GET http://wcr.htcsense.com/wcr/weather? - >> HIER_DIRECT/204.236.220.97 - >> 1399271191.084 05/May/2014:11:26:31 +0500 4959 84:3w:28:49:b9:e5 >> 10.x.x.x TCP_MISS_ABORTED/000 0 GET http://wcr.htcsense.com/wcr/weather? - >> HIER_DIRECT/204.236.220.97 - >> 1399271225.142 05/May/2014:11:27:05 +0500 5014 84:3w:28:49:b9:e5 >> 10.x.x.x TCP_MISS_ABORTED/000 0 GET http://wcr.htcsense.com/wcr/weather? - >> HIER_DIRECT/204.236.220.97 - > > It seems the difference is TCP_MISS/200 and TCP_MISS_ABORTED/000. Can u help > me to udnerstand what is wrong here? ABORTED/000 means the client disconnected before the server produced any response. It seems your connectivity to 204.236.220.97 has problems if I am reading that custom log format right. The usual culprits are broken ECN, Window Scaling, PMTUd, ICMP, or one-way NAT rules. Amos
