Android client flooding squid

Heiler Bemerguy <heiler.bemerguy@xxxxxxxxxxxxxx> · Tue, 12 Dec 2017 11:46:22 -0300



    Hi guys,
    Everyday I get tons of these GETs, a lot from the same IP, then a
      lot from other IPs of our local intranet (we have some APs plugged
      on our intranet). This is happening since forever, but I'm trying
      to understand/get rid of it.
    Any ideas?

    
    1513079234.177      1 10.20.5.2 TCP_HIT/301 619 GET
      http://172.217.28.132/ - HIER_NONE/- text/html

      1513079234.280      1 10.20.5.2 TCP_HIT/301 619 GET
      http://172.217.28.132/ - HIER_NONE/- text/html

      1513079234.379      1 10.20.5.2 TCP_HIT/301 619 GET
      http://172.217.28.132/ - HIER_NONE/- text/html

      1513079234.485      1 10.20.5.2 TCP_HIT/301 619 GET
      http://172.217.28.132/ - HIER_NONE/- text/html

      1513079234.587      1 10.20.5.2 TCP_HIT/301 619 GET
      http://172.217.28.132/ - HIER_NONE/- text/html

      1513079234.695      1 10.20.5.2 TCP_HIT/301 619 GET
      http://172.217.28.132/ - HIER_NONE/- text/html

      1513079234.802      1 10.20.5.2 TCP_HIT/301 619 GET
      http://172.217.28.132/ - HIER_NONE/- text/html

      1513079235.187      1 10.20.5.2 TCP_HIT/301 619 GET
      http://172.217.28.132/ - HIER_NONE/- text/html

      1513079235.291      2 10.20.5.2 TCP_HIT/301 619 GET
      http://172.217.28.132/ - HIER_NONE/- text/html
    tcpdumped, client request:

    
      GET http://172.217.28.132/ HTTP/1.1

        User-Agent: Dalvik/1.6.0 (Linux; U; Android 4.3; GT-I9505
        Build/JSS15J)

        Host: www.google.com

        Connection: close
    
    proxy response:
    
      HTTP/1.1 301 Moved Permanently

        Location: http://www.google.com/

        Content-Type: text/html; charset=UTF-8

        Date: Tue, 12 Dec 2017 10:34:02 GMT

        Expires: Thu, 11 Jan 2018 10:34:02 GMT

        Cache-Control: public, max-age=2592000

        Server: gws

        Content-Length: 219

        X-XSS-Protection: 1; mode=block

        X-Frame-Options: SAMEORIGIN

        Age: 14658

        X-Cache: HIT from proxy

        Via: 1.1 proxy (squid)

        Connection: close

        
        <HTML><HEAD><meta http-equiv="content-type"
        content="text/html;charset=utf-8">

        <TITLE>301 Moved</TITLE></HEAD><BODY>

        <H1>301 Moved</H1>

        The document has moved

        <A HREF="" class="moz-txt-link-rfc2396E" href="http://www.google.com/">"http://www.google.com/">here</A>.

        </BODY></HTML>

      
    -- 
Atenciosamente / Best Regards,

Heiler Bemerguy
Network Manager - CINBESA
55 91 98151-4894/3184-1751
  

_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users