Re: [squid-users] Invalid Requests in access.log

wh_at_msdrd.com wrote:
> Hello.
>
> I was looking in my access.log file, again, and found other wierd stuff,
> again, the log is full of stuff like these:
>
> 2008/12/14 22:40:25| clientProcessRequest: Invalid Request
> 2008/12/14 22:40:32| clientParseRequestMethod: Unsupported method in
> request 'NICK [M|CRI|XP|10117]
> '
> 2008/12/14 22:40:32| clientProcessRequest: Invalid Request
> 2008/12/14 22:40:39| clientParseRequestMethod: Unsupported method in
> request 'NICK [M|CRI|XP|02519]
> '
> 2008/12/14 22:40:39| clientProcessRequest: Invalid Request
> 2008/12/14 22:40:46| clientParseRequestMethod: Unsupported method in
> request 'NICK [M|CRI|XP|86755]
> '
> 2008/12/14 22:40:46| clientProcessRequest: Invalid Request
> 2008/12/14 22:40:54| clientParseRequestMethod: Unsupported method in
> request 'NICK [M|CRI|XP|43887]
> '
> 2008/12/14 22:40:54| clientProcessRequest: Invalid Request
> 2008/12/14 22:41:01| clientParseRequestMethod: Unsupported method in
> request 'NICK [M|CRI|XP|34635]
> '
> 2008/12/14 22:41:01| clientProcessRequest: Invalid Request
> 2008/12/14 22:41:08| clientParseRequestMethod: Unsupported method in
> request 'NICK [M|CRI|XP|84846]
> '
> 2008/12/14 22:41:08| clientProcessRequest: Invalid Request
> 2008/12/14 22:41:15| clientParseRequestMethod: Unsupported method in
> request 'NICK [M|CRI|XP|13599]
> '
> 2008/12/14 22:41:15| clientProcessRequest: Invalid Request
> 2008/12/14 22:41:22| clientParseRequestMethod: Unsupported method in
> request 'NICK [M|CRI|XP|60428]
> '
> 2008/12/14 22:41:22| clientProcessRequest: Invalid Request
> 2008/12/14 22:41:29| clientParseRequestMethod: Unsupported method in
> request 'NICK [M|CRI|XP|99030]
> '
> 2008/12/14 22:41:29| clientProcessRequest: Invalid Request
> 2008/12/14 22:41:36| clientParseRequestMethod: Unsupported method in
> request 'NICK [M|CRI|XP|02937]
> '
> 2008/12/14 22:41:36| clientProcessRequest: Invalid Request
> 2008/12/14 22:41:43| clientParseRequestMethod: Unsupported method in
> request 'NICK [M|CRI|XP|50998]
> '
> 2008/12/14 22:41:43| clientProcessRequest: Invalid Request
>
>
> What is all that? Is someone trying to hack the system or what?

Someone is trying to use SIP or similar software through your proxy.

A transparently intercepting proxy may expect to see that nowdays as
more non-HTTP software are using the only unblocked port available.

If you don't use interception, then the client may be broken or your
squid may need to use extension_methods for them.

Amos

-- 
Please be using
   Current Stable Squid 2.7.STABLE5 or 3.0.STABLE10
   Current Beta Squid 3.1.0.3 or 3.0.STABLE11-RC1