> We're seeing this on most of our clients machines (and we've implemented> regexes to block Code Red v1 and v2), however, the requests you're
> seeing are from the second generation Code Red (called Code Red II--not
> the same as v1 and v2). Code Red II, according to a post I read a
> couple of days ago (maybe here) sends malformed requests which are never
> serviced by Squid.
>
> As far as I know, the NONE/411 tells you that Squid is not servicing
> that request and so is stopping further propogation of Code Red II. I'm
> no longer seeing any of the v1/v2 versions of Code Red show up in the
> logs of our clients, and I think it has been replaced by Code Red II in
> most machines.
>
> I think you're probably hitting some other snag that is causing your
> proxy to hang. I don't think Code Red can do it unless you have many
> hosts on your network that are infected.
>
yes , squid is not servicing that requests and propogation is stoppping ,
but netstat showes, that requests have 'SYN_RECV' status code, and this
connections stay for a very long time. I think thats why server hangs: new Code
Red connections arrives , squid cand proceed them and they stay open.
so is there any method for closing that unserviced connects ???
Received on Wed Aug 08 2001 - 03:05:30 MDT
This archive was generated by hypermail pre-2.1.9 : Tue Dec 09 2003 - 17:01:30 MST