Re: [squid-users] swuid / worm weirdness

On Fri, 12 Sep 2003, Brad Groshok wrote:

> Still tailing squid access.log
> Its still showing that IP address making requests to random ip addresses.
> 10 min later!!!

Probably requests timing out. Squid does not know that you cut the DSL
connection and still thinks the client is waiting for responses to the
requests it has already sent.

> Sample access.log:
>
> 1063418773.024 240213 x.x.x.x TCP_MISS/504 1353 GET
> http://219.30.176.25/ - NONE/- text/html

Note the second field. This tells how long ago the request was sent by the
client. In the above line the request was sent 240 seconds (4 minutes)
ago.

Regards
Henrik
Received on Sat Sep 13 2003 - 05:11:29 MDT