Hello, Henrik Nordstrom wrote: > > What does the requests you send to Squid look like?
A typical request looks like: PUT http://learning.plans/cachepurger HTTP/1.0 Date: Wed Oct 06 01:14:10 2004 GMT Server: ISP Systems CachePusher 1.0 Content-Type: text/html Content-Length: 2232 Last-Modified: Mon Oct 04 02:47:34 2004 GMT Proxy-Connection: keep-alive <HTML> <HEAD> <TITLE>Squid Cache Purger DOWNLOAD</TITLE> </HEAD> <body bgcolor="seashell" link="blue" vlink="green" leftmargin="50" topmargin="0"> <center> <table> <tr><th><font size=4>ISP Systems' Squid Cache Purger</font></th></tr> <tr></tr> <tr><td> </td></tr> <tr><td align=left> <font size=3> <b>Squid Cache Purger allows users to purge entries in the Squid cache by searching for key words and/or urls.<br> Users will be presented with a list of found entries and then be allowed to select which cached entries to purge.<p> I developed the script to support another project I am working on, but I<br> thought this module might be useful as a stand alone to other people.<p> Developed by: ISP Systems<br> Version: beta<br> Language: Perl<br> License: <a href="http://www.gnu.org/copyleft/gpl.html"><b>GNU General Public License (GPL)</b></a><p> Download: <a href="cachepurger/cachepurger.tar.gz"><b>cachepurger.tar.gz</b></a><br> Updated: 3 Mar 2004 20:33 <p> Installation instructions are included in the tarball, or you can view the <a href="cachepurger/README"><b>README</b></a> file. </b></font> </td></tr> <tr><td> </td></tr> </table> <p> <table> <tr><th><font size=4>Other Projects</font></th></tr> <tr></tr> <tr><td> </td></tr> <tr><td align=left> <font size=3> <a href="squidsearch/"><b>Squid Search Engine</b></a><br> </td></tr> <p> <tr><td align=left> <b>SquidSearch allows users to search for key words in the Squid cache.<p> It searches the binary files that make up the cache, and pulls key words from the "META tags" and "body" of the cached files. "Links" to the stored files are created by parsing the meta data in the header of the cache files until the<br> STORE_META_URL token is found. </td></tr> <tr><td> </td></tr> <tr><td align=left> <font size=3> <a href="http://www.bogopop.com/bogopop/"><b>BogoPop Spam Filtering System</b></a><br> </td></tr> <tr><td align=left> <font size=3> <b>BogoPop is an MS Windows based email spam filtering system based on Naive Bayesian categorization theory with an inverse chi-square convergence accelerator.<p> </b></font> </td></tr> </table> </center> </body> </HTML> Like I said, during a multiple file push session, the first entry shows up in cache.log and gets cached, but the other entries do not show up in cache.log, and do not get cached. But all the entries show up in snort as they pass through port 3128. > > ngrep is a generally better tool for looking at the HTTP protcol details. I have never used it! But I will look into it! Thanks, Murrah Boswell