On 20/02/2012 1:39 a.m., Mustafa Raji wrote:
hi i installed a squid box with one interfaces this interfaces is connected to mikrotik , which in turn connected to the net now when i check the traffic from the cache server using iptables with -v option it show that the amount of traffic passing through the input chain (which i suppost the traffic coming from the internet)
No. INPUT chain handles all traffic entering software on the box (ie from client to Squid, *plus* from Interent to Squid). This is possibly confusing your analysis. Also the -v shows many rules counters, Without seeing the displayit is hard to tell what you are looking at.
I would suggest creating a LOG rule or empty chain first in your iptables config that matches on the particular traffic you want to measure (port 80 coming or going to anywhere not on your LAN). Using that rules counter as a traffic measure.
bigger than the amount of traffic that passes through the output chain(which i suppost it's client traffic),
No. OUTPUT chain handles all traffic leaving software on the box (ie Squid to client, *plus* Squid to Internet). To measure local traffic use a line same as the one suggested for INPUT.
NP: I do find it very strange that while watching a video more is arriving than leaving. Even a cache HIT should not have that behaviour. This seems like something very strange is going on (compressing data as it passes through? fetching a whole large file for delivering only a small range of it?)
why this happened , there is no cache error or warning in the cache.log file and the cache server seems working fine when i take a look at the access.log, as a test i checked the rule for cached objects, when i open a video that cached in the squid box, the video is served normally but the amount of traffic in the input chain increases, why the video is work from the cache in the client side, even i though the increase of traffic in input chain increases so fast (ex 18Mb in about 5 second) i really don't have this bandwidth so the video is served from the cache,please can you help me if the video served from the cache why there is an addition in the input chain , this chain that suppost to serve only stale object from the page
I think most of wahat you are seeing is client-to-squid traffic and the resulting squid-to-client traffic. But there are some weirdness, like INPUT chain increasing very much. So a cleaner analysis would be worthwhile just to be certain what is actually going on.
Amos
