On Wed, 14 Apr 2004 Hanno.Wagner@boerse-stuttgart.de wrote:
> I checked the logfile and there I found a (maybe) strange entry - at least
> it was strange for me:
>
> 1081939891.711 16394 192.168.82.17 TCP_MISS/200 3689396 GET
> http://nagios.sourceforge.net/download/contrib/documentation/english/Nagios_1_0_Docs.pdf
> - DIRECT/66.35.250.209 application/pdf
Here you got the whole file.
> 1081940037.382 48 192.168.82.17 TCP_IMS_HIT/304 229 GET
> http://nagios.sourceforge.net/download/contrib/documentation/english/Nagios_1_0_Docs.pdf
> - NONE/- application/pdf
Your browser thinks it has the file and only asked if it has changed,
which it had not.
[repeated 3 times]
> So apparently the file gets downloaded from the cache - but (whyever) not
> transported completely to my IE. But squid thinks he has been successfull
> because on the next requests he answers with "not modified", so IE should
> take it out of his cache.
Probably your IE actually got the file but failed to save it, corrupting
the local browser cache on your station.
The best way to inspect whos fault it is here is to look at the traffic
with tcpdump.
tcpdump -w trace.pcap -s 1600 host 192.168.82.17
then clear your browser cache and request the document. When finished stop
tcpdump.
Now look into the file by using
tcpdump -r trace.pcap -n
and
ngrep -I trace.pcap
You should see the traffic flowing of the whole document, and in the end
either a FIN->FIN+ACK->ACK sequence or just ACKs.. (no RESET).
Regards
Henrik
Received on Wed Apr 14 2004 - 05:51:35 MDT
This archive was generated by hypermail pre-2.1.9 : Fri Apr 30 2004 - 12:00:02 MDT