Re: [squid-users] Strange source-IP-addresses in access.log

On Wed, Mar 06, 2002, Boosten, Peter wrote:
> Hi all,
>
> We're experiencing a very strange problem with our Squid 2.2Stable4:
>
> Encountered over one day, we've seen about 400 users (out of 6000) browsing
> the internet from their normal IP-addresses, but once in a while a strange
> IP-address shows up (in stead of their own IP-address). That strange
> IP-address is out of our own IP-range and somewhere on the internet.

Can you tell us what the IP address (or the first two numbers)
are ?

Are the first two parts always the same?

Adrian

> The ip-address isn't traceable or routeable from the internal network, so it
> isn't a anonymous proxy.
>
> Right after the request from the strange IP-address, the same request is
> logged in access.log with the correct IP-address.
>
> Any one seen this kind of behaviour? We're suspecting some kind of spyware,
> but maybe it's just a glitch in Squid.
>
> TIA.
>
> Kind regards,
>
> Peter Boosten
>
>
> Disclaimer
> 1. This e-mail is for the intended recipient only. If you have received it
> by mistake please let us know by reply and then delete it from your system;
> access, disclosure, copying, distribution or reliance on any of it by anyone
> else is prohibited.
>
> 2. If you as intended recipient have received this e-mail incorrectly,
> please notify the sender (via e-mail) immediately. This e-mail is
> confidential and may be legally privileged. DSM does not guarantee that the
> information sent and/or received by or with this e-mail is correct and does
> not accept any liability for damages related thereto.
Received on Wed Mar 06 2002 - 01:13:10 MST