[squid-users] windowsupdate: repeated web requests

From: John C. Gale <John_Gale@dont-contact.us>
Date: Wed, 29 Aug 2001 18:11:22 -0400

I'm using squid-2.3.STABLE4 on a linux box. I'm seeing a large amount
of repeated requests from the same nodes for the same file...

999121802.978 5 152.13.122.111 TCP_HIT/200 4165 GET
http://windowsupdate.microsoft.com/R778/v31content/90716/90716.cab - NONE/-
application/x-compressed
999121803.072 8 152.13.130.91 TCP_HIT/200 4165 GET
http://windowsupdate.microsoft.com/R778/v31content/90716/90716.cab - NONE/-
application/x-compressed
999121803.141 5 152.13.115.30 TCP_HIT/200 4165 GET
http://windowsupdate.microsoft.com/R778/v31content/90716/90716.cab - NONE/-
application/x-compressed
999121803.463 3 152.13.128.125 TCP_HIT/200 4165 GET
http://windowsupdate.microsoft.com/R778/v31content/90716/90716.cab - NONE/-
application/x-compressed
999121803.493 4 152.13.134.132 TCP_HIT/200 4165 GET
http://windowsupdate.microsoft.com/R778/v31content/90716/90716.cab - NONE/-
application/x-compressed
999121803.588 3 152.13.130.91 TCP_HIT/200 4165 GET
http://windowsupdate.microsoft.com/R778/v31content/90716/90716.cab - NONE/-
application/x-compressed
999121803.656 3 152.13.115.30 TCP_HIT/200 4165 GET
http://windowsupdate.microsoft.com/R778/v31content/90716/90716.cab - NONE/-
application/x-compressed
999121803.982 4 152.13.128.125 TCP_HIT/200 4165 GET
http://windowsupdate.microsoft.com/R778/v31content/90716/90716.cab - NONE/-
application/x-compressed
999121804.008 4 152.13.134.132 TCP_HIT/200 4165 GET
http://windowsupdate.microsoft.com/R778/v31content/90716/90716.cab - NONE/-
application/x-compressed

This goes on and on and on. So, I did a search in google on 90716.cab
and found a few other squid hosts displaying their logs to the world
that listed this same file with relative frequency. I didn't find much
else though.

I don't use windows, so I really don't know much about windowsupdate.
I certainly don't know why this is not "finishing" on the PC side.
I have the log space and am not worried that few hosts are going
nuts... but these few hosts have requested this file 175,985 times
since my logs rotated at 4am this morning (14 hours elapsed).

This could be a real problem if a significant number of nodes were doing
this and not just a few.

Any ideas? Thanks.

- John

-- 
Always store beer in a dark place.
		-- Lazarus Long
Received on Wed Aug 29 2001 - 16:11:26 MDT

This archive was generated by hypermail pre-2.1.9 : Tue Dec 09 2003 - 17:01:57 MST