You'll need a binary wireshark trace to figure this one out. On 22/01/2013, at 6:56 PM, 오재경 <[email protected]> wrote:
> In these days traffic servers(3.2.0) report "status 400 (Invalid HTTP > Request)" in error.log. > > > one trafficserver processes 20,000 sessions per second and 400 error happens > 4~5 every minute. > > > we've captured huge amount of packet, searched, and found what's going on > between client and ATS. > > > wireshark dumps that show the moment of 400 error are: > > > source destination protocol length info > > -------------------------------------------------------------------------------------------------------------------- > > client -> ats tcp 62 12822 > http [SYN] seq=0 > win=65535 Len=0 MSS=1460 SACK_PERM=1 > > ATS _ client tcp 62 http > 12822 [SYN, ACK] Seq=0 > Ack=1 Win=4380 Len=0 MSS=1460 SACK_PERM=1 > > client -> ats tcp 60 12822 > http [ACK] Seq=1 Ack=1 > Win=65535 Len=0 > > client -> ats tcp 1514 [TCP segment of a reassembled PDU] > > ATS _ client tcp 54 http > 12822 [ACK] Seq=1 Ack=1461 > Win=7300 Len=0 > > client -> ats tcp 60 12822 > http [RST, ACK] Seq=1528 > Ack=1 Win=0 Len=0 > > client -> ats http 121 [TCP Retransmission] GET > /path/to/image_file/xxxx.jpg HTTP/1.1 > > ATS _ client tcp 54 http > 12822 [RST] Seq=1 Win=0 > Len=0 > > client -> ats tcp 60 12822 > http [RST] Seq=1461 Win=0 > Len=0 > > > > another case > > > client -> ats tcp 60 amx-weblink > http [SYN] Seq=0 > Win=65535 Len=0 MSS=1460 > > ATS _ client tcp 58 http > amx-weblink [SYN, ACK] > Seq=0 Ack=1 Win=4380 Len=0 MSS=1460 > > client -> ats tcp 60 amx-weblink > http [ACK] Seq=1 > Ack=1 Win=65535 Len=0 > > client -> ats tcp 590 [TCP segment of a reassembled PDU] > > ATS _ client tcp 54 http > amx-weblink [ACK] Seq=1 > Ack=537 Win=5360 Len=0 > > client -> ats tcp 590 [TCP segment of a reassembled PDU] > > ATS _ client tcp 54 http > amx-weblink [ACK] Seq=1 > Ack=1073 Win=6432 Len=0 > > client -> ats tcp 60 amx-weblink > http [RST, ACK] > Seq=1073 Ack=1 Win=0 Len=0 > > > > anyone can tell why/how those packets makes 400 error? > > > it's not ATS bug? Thanks in advance. > > >
