[squid-users] Strange source-IP-addresses in access.log

Hi all,

We're experiencing a very strange problem with our Squid 2.2Stable4:

Encountered over one day, we've seen about 400 users (out of 6000) browsing
the internet from their normal IP-addresses, but once in a while a strange
IP-address shows up (in stead of their own IP-address). That strange
IP-address is out of our own IP-range and somewhere on the internet.

The ip-address isn't traceable or routeable from the internal network, so it
isn't a anonymous proxy.

Right after the request from the strange IP-address, the same request is
logged in access.log with the correct IP-address.

Any one seen this kind of behaviour? We're suspecting some kind of spyware,
but maybe it's just a glitch in Squid.

TIA.

Kind regards,

Peter Boosten

Disclaimer
1. This e-mail is for the intended recipient only. If you have received it
by mistake please let us know by reply and then delete it from your system;
access, disclosure, copying, distribution or reliance on any of it by anyone
else is prohibited.

2. If you as intended recipient have received this e-mail incorrectly,
please notify the sender (via e-mail) immediately. This e-mail is
confidential and may be legally privileged. DSM does not guarantee that the
information sent and/or received by or with this e-mail is correct and does
not accept any liability for damages related thereto.
Received on Wed Mar 06 2002 - 01:11:02 MST