Re: strange LOG_NONE requests

Duane Wessels wrote:
>
> cb@brewhq.swb.de writes:
>
> >>> With the new cachemgr.cgi that comes with 1.1beta, it's reminded
> >>> me to ask about the strange IP addresses that attempt to request
> >>> LOG_NONE. Some of them I can probably account for since my proxy is
> >>> 'announced' (but firmly acl'ed) as they are routable. Others, however,
> >>> include:
> >>> 67.1.0.0
> >>> 170.50.0.0
> >>> 0.4.0.0
> >>
> >[...]
> >>Pardon my ignorance, but what am I looking at here, and why is this from
> >>both end-users (clients), and from peer proxies?
> >>
> >Yup, I'd like to know that as well (seeing such entries from
> >routable and non-routable or non-reachable address). Esp. since the
> >Squid here is also ACL'ed against accesses from outside the domain...
>
> LOG_NONE means that someone connected to the HTTP port, but did not
> make any sort of HTTP request. I.e. you get this if you make a connection
> and then disconnect it immediately.
>
> I have no idea why the IP numbers are goofy. They're simply taken
> from the sockaddr return parameter of the accept() call.

It's possible that we're failing to take an error-return into account,
and pulling uninitialized data out of a connection that didn't
successfully complete.

D
Received on Sun Oct 27 1996 - 16:26:35 MST