According to my other post http://squid-web-proxy-cache.1019090.n4.nabble.com/Squid-cpu-usage-100-from-few-days-ago-td4678894.html Squid cpu usage becomes 100% when it forwatds some kind of malformed http traffic . Even one ip address with less than 5 requests per second can grow squid cpu usage up to 30% We have found that this request belongs to a cheap popular satellite receiver www.starmax.co . Maybe it has been infected and becomes zombie of a btnet . Apart from the client type , my question is Shouldn't squid have a mechanism to defend this types of problems ? Isn't possible for squid to simply ignore malformed http requests ? Is there any workaround to prevent this problem ? Squid is in tproxy mode with routing Ubuntu Linux 16.04 , 4.4.0-34-generic on x86_64 Squid Cache: Version 3.5.19 from debian repository samples % image name symbol name 1532894 42.8190 libc-2.23.so _IO_strn_overflow 1028537 28.7306 libc-2.23.so _IO_default_xsputn 662802 18.5143 libc-2.23.so vfprintf 77019 2.1514 squid /usr/sbin/squid 28861 0.8062 libc-2.23.so __memset_sse2 26948 0.7528 r8169 /r8169 25320 0.7073 libc-2.23.so __memcpy_sse2_unaligned 21712 0.6065 libc-2.23.so __GI___mempcpy 14918 0.4167 libc-2.23.so _int_malloc 8889 0.2483 nf_conntrack /nf_conntrack 8130 0.2271 libc-2.23.so __GI_strchr 6357 0.1776 libc-2.23.so _int_free 4152 0.1160 libc-2.23.so re_search_internal 4043 0.1129 libc-2.23.so strlen 2754 0.0769 libstdc++.so.6.0.21 /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.21 2753 0.0769 libc-2.23.so free 2704 0.0755 ip_tables /ip_tables 2560 0.0715 reiserfs /reiserfs 2332 0.0651 kallsyms ___slab_alloc 2284 0.0638 libc-2.23.so malloc_consolidate 2204 0.0616 libc-2.23.so malloc 2175 0.0608 kallsyms sys_epoll_ctl 2035 0.0568 kallsyms csum_partial_copy_generic 1614 0.0451 libc-2.23.so calloc 1552 0.0434 kallsyms _raw_spin_lock 1208 0.0337 kallsyms memcpy 1203 0.0336 kallsyms nf_iterate 1177 0.0329 kallsyms irq_entries_start 1165 0.0325 kallsyms __fget 1072 0.0299 kallsyms copy_user_generic_string 1037 0.0290 kallsyms __alloc_skb 1002 0.0280 kallsyms tcp_sendmsg 945 0.0264 libc-2.23.so build_upper_buffer 875 0.0244 kallsyms kmem_cache_free 873 0.0244 kallsyms tcp_rack_mark_lost 868 0.0242 nf_nat_ipv4 /nf_nat_ipv4 861 0.0241 kallsyms kfree 837 0.0234 kallsyms __inet_lookup_established 834 0.0233 kallsyms get_partial_node.isra.61 825 0.0230 kallsyms __slab_free 815 0.0228 kallsyms sock_poll 810 0.0226 kallsyms skb_release_data 802 0.0224 nf_conntrack_ipv4 /nf_conntrack_ipv4 792 0.0221 kallsyms tcp_transmit_skb 771 0.0215 kallsyms kmem_cache_alloc 719 0.0201 kallsyms fib_table_lookup 704 0.0197 kallsyms _raw_spin_lock_irqsave 701 0.0196 kallsyms tcp_v4_rcv 699 0.0195 libm-2.23.so __ieee754_log_avx 686 0.0192 nf_nat /nf_nat 684 0.0191 kallsyms tcp_write_xmit 674 0.0188 kallsyms __cmpxchg_double_slab.isra.44 626 0.0175 kallsyms __netif_receive_skb_core 621 0.0173 libnettle.so.6.2 /usr/lib/x86_64-linux-gnu/libnettle.so.6.2 608 0.0170 kallsyms delay_tsc 600 0.0168 kallsyms ksize 595 0.0166 kallsyms tcp_ack 592 0.0165 kallsyms __local_bh_enable_i -- View this message in context: http://squid-web-proxy-cache.1019090.n4.nabble.com/Malformed-HTTP-on-tproxy-squid-tp4678951.html Sent from the Squid - Users mailing list archive at Nabble.com. _______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx http://lists.squid-cache.org/listinfo/squid-users
