Re: [squid-users] cache.log errors

jendalsepit wrote:
>
>
> Amos Jeffries-2 wrote:
>> On Tue, 01 Sep 2009 14:38:57 +0200, Mark Lodge <mlodgesa_at_gmail.com> wrote:
>>> What can be the cause of these errors in my cache.log?
>>>
>>> 2009/08/31 07:35:02| storeDirWriteCleanLogs: Starting...
>>> 2009/08/31 07:35:02| Finished. Wrote 6991 entries.
>>> 2009/08/31 07:35:02| Took 0.0 seconds (2124924.0 entries/sec).
>>> 2009/08/31 07:35:02| logfileRotate: /var/log/squid/store.log
>>> 2009/08/31 07:35:02| logfileRotate (stdio): /var/log/squid/store.log
>>> 2009/08/31 07:35:02| logfileRotate: /var/log/squid/access.log
>>> 2009/08/31 07:35:02| logfileRotate (stdio): /var/log/squid/access.log
>>> 2009/08/31 07:35:02| helperOpenServers: Starting 7 'python' processes
>>> 2009/08/31 07:46:38| sslReadClient: FD 36: read failure: (110)
>>> Connection timed out
>>> 2009/08/31 08:17:16| clientTryParseRequest: FD 27 (10.0.0.50:37271)
>>> Invalid Request
>>> 2009/08/31 08:19:57| parseHttpRequest: Unsupported method '
'
>>> 2009/08/31 08:19:57| clientTryParseRequest: FD 27 (10.0.0.50:49041)
>>> Invalid Request
>> Somebody at 10.0.0.50 pushing a binary protocol through port 80.
>> Your Squid is detecting it and dropping the connection.
>>
>> Amos
>>
>>
>
> i am still stuck on this issue: clientTryParseRequest: Invalid Request,
> do you know how to solve it?
>
> thanks :)

As I said its a binary protocol. Not HTTP. Looking a bit deeper I see
that those three bytes match someone starting a VoIP phone call.

How is the data entering Squid?

  - "transparent" interception?
    solution: turn off interception.

  - client sending it to their configured proxy?
    solution: kick the client until they fix their end.

There are no other solutions available (yet) in Squid.

Amos

-- 
Please be using
   Current Stable Squid 2.7.STABLE6 or 3.0.STABLE18
   Current Beta Squid 3.1.0.13