On 6/07/2012 6:25 a.m., x-man wrote:
Hello,
I'm running squid 3.1.19 in tproxy mode, and I have some customers
complaining that they have problem with stock exchange (share market) sites
and software after implementing the squid. What I saw in the access.log for
one of the customers is:
10.21.8.59 - - [04/Jul/2012:12:01:56 +0530] "GET
http://login.angeltrade.com/AngeltradeDiet/DietOdinSingleInterface.asp?
HTTP/1.1" 200 3557 TCP_MISS:DIRECT
10.21.8.59 - - [04/Jul/2012:12:01:57 +0530] "NONE error:invalid-request
HTTP/0.0" 400 4021 NONE:NONE
<snip>
10.21.8.59 - - [04/Jul/2012:12:02:11 +0530] "NONE error:invalid-request
HTTP/0.0" 400 4021 NONE:NONE
10.21.8.59 - - [04/Jul/2012:12:02:12 +0530] "NONE error:invalid-request
HTTP/0.0" 400 4021 NONE:NONE
What would this mean?
Something that is not HTTP was sent over port-80 by the client.
What can I do to further investigate the case and probably resolve it...
"tcpdump -s 0" will give you a packet trace you can analyse and see what
the client is doing.
Amos
