On 09/28/2016 09:41 AM, Antony Stone wrote: > On Wednesday 28 September 2016 at 17:37:58, Alex Rousskov wrote: > >> AFAICT, Squid did not receive a request for www.ru: >>> $ egrep -c 'wwww.ru|217.112.35.75' cache.log.debug >>> 0 >>> >>> $ tshark -V -r squid-stuck-reference-client.pcap | egrep -c >>> 'wwww.ru|217.112.35.75' 0 > > Is that a direct copy'n'paste from your terminal? > > If so, you tried one too many w's :( Indeed! Fixing that exposes one HTTP request in the capture file. Unfortunately, 1. Squid responded to that request (with a 407 message). Follow (tcp.stream eq 32) in Wireshark. 2. Squid did not receive this request when debugging was on: $ egrep -c 'www.ru|217.112.35.75' cache.log.debug 0 It may be important to know that the captured request was received at minute 53 while Squid debugging starts at minute 58 (I assume the difference in hours is due to time zone effects and such). Another potentially important fact that it took almost two minutes for the 407 response to show up in the capture. It is not clear (to me) whether the delay was due to network problems (in one or both directions) or due to Squid. Again, follow (tcp.stream eq 32) in Wireshark to see the details. The "I do not know which transaction got stuck and whether that transaction go cache-logged" conclusion and suggestions in my original response still apply AFAICT. Thank you, Alex. _______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx http://lists.squid-cache.org/listinfo/squid-users