Re: [squid-users] Re: ask more about incremental ping

From: Henrik Nordstrom <hno@dont-contact.us>
Date: Wed, 30 Mar 2005 20:01:38 +0200 (CEST)

On Wed, 30 Mar 2005, dwi amk wrote:

> What I don't understand that is that it happens recently, I never
> experience like this before. If Henrik said this not DNS related at
> all, then I suspect it's worm or something alike.

Could be a worm. Could also be one of your users doing something slightly
differently, or using a "download accelerator" or the like.

> If so how to prevent something like this happening, I put in ACL all
> things around how to deny or even tcp_reset worm,spam or alike that i
> found from searching.

You can use access.log and cachemgr to try to identify what requests are
causing this problem.

As I said, if the problem is due to some requests building up in Squid
then you should see them logged in access.log when your restart Squid
after detecting the problem, easily identifiable by

   a) Log timestamp at the time Squid was shut down.
   b) Very long response time

Regards
Henrik
Received on Wed Mar 30 2005 - 11:01:45 MST

This archive was generated by hypermail pre-2.1.9 : Fri Apr 01 2005 - 12:00:03 MST