RE: [squid-users] Squid TCP_MISS/502

Hello Amos

Here is the output that you required, please accept my apologies for sending this so late.

2010/01/27 11:49:08| Reconfiguring Squid Cache (version 3.0.STABLE10)...
2010/01/27 11:49:08| FD 161 Closing HTTP connection
2010/01/27 11:49:08| FD 163 Closing ICP connection
2010/01/27 11:49:08| Processing Configuration File: /etc/squid/squid.conf (depth 0)
2010/01/27 11:49:08| Initializing https proxy context
2010/01/27 11:49:28.716| httpMakeVaryMark: accept-encoding="identity,gzip,deflate"
2010/01/27 11:49:28.770| httpStart: "GET http://old.nabble.com/Linux-mod_auth_ntlm_winbind-and-TortoiseSVN-td19756507.html"
2010/01/27 11:49:28.770| http.cc(73) HttpStateData 0x2b214da67988 created
2010/01/27 11:49:28.770| httpSendRequest: FD 174, request 0x2b214d95c950, this 0x2b214da67988.
2010/01/27 11:49:28.770| http.cc(1206) may read up to 4095 bytes from FD 174
2010/01/27 11:49:28.770| decideIfWeDoRanges: range specs: 0, cachable: 1; we_do_ranges: 0
2010/01/27 11:49:28.770| httpBuildRequestHeader: Host: old.nabble.com
2010/01/27 11:49:28.770| httpBuildRequestHeader: User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7 (.NET CLR 3.5.30729)
2010/01/27 11:49:28.770| httpBuildRequestHeader: Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
2010/01/27 11:49:28.770| httpBuildRequestHeader: Accept-Language: en-gb,en;q=0.5
2010/01/27 11:49:28.770| httpBuildRequestHeader: Accept-Encoding: identity,gzip,deflate
2010/01/27 11:49:28.770| httpBuildRequestHeader: Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
2010/01/27 11:49:28.770| httpBuildRequestHeader: Keep-Alive: 300
2010/01/27 11:49:28.770| httpBuildRequestHeader: Proxy-Connection: keep-alive
2010/01/27 11:49:28.770| httpBuildRequestHeader: Referer: http://www.google.co.za/url?sa=t&source=web&ct=res&cd=7&ved=0CBkQFjAG&url=http%3A%2F%2Fold.nabble.com%2FLinux-mod_auth_ntlm_winbind-and-TortoiseSVN-td19756507.html&rct=j&q=libsmb%2Fntlmssp.c%3Antlmssp_update(334)+++got+NTLMSSP+command+3%2C+expected+1&ei=RgtgS8nyC5Cx4Qad54j1Cw&usg=AFQjCNFRdfKkzLzhmxGgQpNDXJs-jiOwNg
2010/01/27 11:49:28.770| httpBuildRequestHeader: Cookie: __qca=P0-1811217371-1264161407178; anonymousId=joe-181842; tview=classic; customStyle=10677; searchterms=libsmb%7Cntlmssp%7Cc%7Cntlmssp_update%7C334%7Cgot%7CNTLMSSP%7Ccommand%7C3%7Cexpected%7C1; JSESSIONID=127r1nirx8s9t; prev=%3Cbig%3E%3Ca%20id%3D%22nabble.prev_search%22%20href%3D%22/forum/Search.jtp%3Fquery%3Dlibsmb%252Fntlmssp.c%253Antlmssp_update%28334%29%2520%2520%2520got%2520NTLMSSP%2520command%25203%252C%2520expected%25201%22%3ESearch%20Nabble%20for%20%22%3Cb%3Elibsmb/ntlmssp.c%3Antlmssp_update%28334%29%20%20%20got%20NTLMSSP%20command%203%2C%20expected%201%3C/b%3E%22%3C/a%3E; channels=4893802913; __utma=151598183.1597776309.1264578545.1264578545.1264585654.2; __utmc=151598183; __utmz=151598183.1264585654.2.2.utmccn=(organic)|utmcsr=google|utmctr=libsmb%2Fntlmssp.c%3Antlmssp_update(334)+++got+NTLMSSP+command+3%2C+expected+1|utmcmd=organic; tview=dump; __utmb=151598183; v=x
2010/01/27 11:49:28.770| httpBuildRequestHeader: If-Modified-Since: Wed, 27 Jan 2010 08:37:19 GMT
2010/01/27 11:49:28.770| httpBuildRequestHeader: If-None-Match: 11:19756507~1:10677~1:10676~1:10547
2010/01/27 11:49:28.770| httpBuildRequestHeader: Cache-Control: max-age=0, max-age=0, max-age=0
2010/01/27 11:49:28.770| httpBuildRequestHeader: Proxy-Authorization: NTLM TlRMTVNTUAADAAAAGAAYAIgAAAAYABgAoAAAABAAEABIAAAAHgAeAFgAAAASABIAdgAAAAAAAAC4AAAABYKIogUBKAoAAAAPVABCAEEARgBSAEkAQwBBAGQAYQB3AGkAZQAuAHAAcgBlAHQAbwByAGkAdQBzAEQAQQBXAEkARQBQAC0ATABUAJAlDcVFx5d7AAAAAAAAAAAAAAAAAAAAAGbCKlx2YoJXXKoFml2B890s8ifalh6QmA==
2010/01/27 11:49:28.770| httpSendRequest: FD 174:
GET http://old.nabble.com/Linux-mod_auth_ntlm_winbind-and-TortoiseSVN-td19756507.html HTTP/1.0
Host: old.nabble.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7 (.NET CLR 3.5.30729)
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-gb,en;q=0.5
Accept-Encoding: identity,gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Referer: http://www.google.co.za/url?sa=t&source=web&ct=res&cd=7&ved=0CBkQFjAG&url=http%3A%2F%2Fold.nabble.com%2FLinux-mod_auth_ntlm_winbind-and-TortoiseSVN-td19756507.html&rct=j&q=libsmb%2Fntlmssp.c%3Antlmssp_update(334)+++got+NTLMSSP+command+3%2C+expected+1&ei=RgtgS8nyC5Cx4Qad54j1Cw&usg=AFQjCNFRdfKkzLzhmxGgQpNDXJs-jiOwNg
Cookie: __qca=P0-1811217371-1264161407178; anonymousId=joe-181842; tview=classic; customStyle=10677; searchterms=libsmb%7Cntlmssp%7Cc%7Cntlmssp_update%7C334%7Cgot%7CNTLMSSP%7Ccommand%7C3%7Cexpected%7C1; JSESSIONID=127r1nirx8s9t; prev=%3Cbig%3E%3Ca%20id%3D%22nabble.prev_search%22%20href%3D%22/forum/Search.jtp%3Fquery%3Dlibsmb%252Fntlmssp.c%253Antlmssp_update%28334%29%2520%2520%2520got%2520NTLMSSP%2520command%25203%252C%2520expected%25201%22%3ESearch%20Nabble%20for%20%22%3Cb%3Elibsmb/ntlmssp.c%3Antlmssp_update%28334%29%20%20%20got%20NTLMSSP%20command%203%2C%20expected%201%3C/b%3E%22%3C/a%3E; channels=4893802913; __utma=151598183.1597776309.1264578545.1264578545.1264585654.2; __utmc=151598183; __utmz=151598183.1264585654.2.2.utmccn=(organic)|utmcsr=google|utmctr=libsmb%2Fntlmssp.c%3Antlmssp_update(334)+++got+NTLMSSP+command+3%2C+expected+1|utmcmd=organic; tview=dump; __utmb=151598183; v=x
If-Modified-Since: Wed, 27 Jan 2010 08:37:19 GMT
If-None-Match: 11:19756507~1:10677~1:10676~1:10547
Via: 1.0 ZATBIMPROXY02 (squid/3.0.STABLE10)
X-Forwarded-For: unknown
Cache-Control: max-age=0


2010/01/27 11:49:28.770| httpSendComplete: FD 174: size 1879: errflag 0.
[2010/01/27 11:51:28, 1] libsmb/ntlmssp.c:ntlmssp_update(334)
  got NTLMSSP command 3, expected 1


I have noticed that I'm getting this error in my cache.log:

[2010/01/27 11:53:40, 1] libsmb/ntlmssp.c:ntlmssp_update(334)
  got NTLMSSP command 3, expected 1

Please can you tell me what this is and how to correct this ?

Dawie Pretorius


-----Original Message-----
From: Dawie Pretorius
Sent: 21 January 2010 07:28 AM
To: 'Amos Jeffries'; squid-users_at_squid-cache.org
Subject: RE: [squid-users] Squid TCP_MISS/502

Hello Amos

We have a windows internal DNS server, I used those DNS servers to resolve my IP's

I changed the dns_nameserver to my ISP dns servers, and the problem went away, loaded ads and the complete page.

I tried this morning eary before most of the staff came in to replicate the problem, but to no avail.

I will try again when the office is busy again. Will send you the logs asap.

Regards,

Dawie Pretorius wrote:
> Hello Amos
>
> The problem was DNS, my apologies for wasting your time.

? how so?

>
> "Meanwhile can you add debug_options 11,9 to your squid.conf and run a
> test please. The resulting cache.log file will have a lot of garbage,
> but amongst that some messages about what headers were received back
> and what happened in the processing"
>
> I can still run this for you and send you the output?

I think yes. I'm intrigued how that came out of a DNS problem.
I'd expect connection or DNs errors to show up.

Amos.

>
> Again thanks! :D
>
> Regards
> Dawie
>
>
>
>
> Dawie Pretorius wrote:
>> Hello Amos
>>
>> Thanks for coming back to me,
>>
>> I upgraded to squid Beta Squid 3.1.0.15, /var/log/squid/access.log now has this error:
>>
>> 1263975667.799 92 172.16.9.158 TCP_MISS/302 1361 GET http://googleads.g.doubleclick.net/pagead/ads? Xxxxxxxxxxxxxxx DIRECT/72.14.204.154 text/html
> <snip repeats>
>
> 302 with that content? Thats a not-modified response from the server.
>
>> Here is the cache.log
>>
> <snip>
>
> Not even a hint of problems.
>
>> Here is the page that I get back from the browser:
>>
>> ERROR
>> The requested URL could not be retrieved
>>
>> Invalid Response error was encountered while trying to process the request:
>>
>> GET
>> /pagead/ads?client=ca-pub-7266757337600734&format=336x280_as&output=h
>> tml&h=280&w=336&lmt=1199983288&channel=5629109116%2B6771450170%2B2275
>> 486144&ad_type=text_image&alternate_ad_url=http%3A%2F%2Fwww.mail-arch
>> ive.com%2Fblank.png&color_bg=FFFFFF&color_border=FFFFFF&color_link=00
>> 6792&color_text=000000&color_url=006792&flash=10.0.32&url=http%3A%2F%
>> 2Fwww.mail-archive.com%2Fsquid-users%40squid-cache.org%2Fmsg51945.htm
>> l&dt=1263975312151&correlator=1263975312153&frm=0&ga_vid=866186005.12
>> 63975312&ga_sid=1263975312&ga_hid=523487483&ga_fc=0&u_tz=120&u_his=1&
>> u_java=0&u_h=1024&u_w=1280&u_ah=1024&u_aw=1280&u_cd=32&u_nplug=8&u_nm
>> ime=24&biw=1280&bih=862&ref=http%3A%2F%2Fwww.google.co.za%2Furl%3Fsa%
>> 3Dt%26source%3Dweb%26ct%3Dres%26cd%3D1%26ved%3D0CAcQFjAA%26url%3Dhttp
>> %253A%252F%252Fwww.mail-archive.com%252Fsquid-users%2540squid-cache.o
>> rg%252Fmsg51945.html%26rct%3Dj%26q%3DTCP_MISS%252F502%2Bsquid%26ei%3D
>> V7tWS7yqK4S9lAeP-dz3Aw%26usg%3DAFQjCNGZUlUd4iFBeTKD1KXThtG3w31cLQ&fu=
>> 0&ifi=1&dtd=3
1
> &xpc=WgwVHxdvOD&p=http%3A//www.mail-archive.com HTTP/1.1
>> Host: googleads.g.doubleclick.net
>> User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7 (.NET CLR 3.5.30729)
>> Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
>> Accept-Language: en-gb,en;q=0.5
>> Accept-Encoding: gzip,deflate
>> Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
>> Keep-Alive: 300
>> Proxy-Connection: keep-alive
>> Referer: http://www.mail-archive.com/squid-users@squid-cache.org/msg51945.html
>> Cookie: test_cookie=CheckForPermission; id=22ac216e0800009b||t=1263975130|et=730|cs=mr_u8kmr
>> Proxy-Authorization: NTLM
>> TlRMTVNTUAADAAAAGAAYAIgAAAAYABgAoAAAABAAEABIAAAAHgAeAFgAAAASABIAdgAAA
>> AAAAAC4AAAABYKIogUBKAoAAAAPVABCAEEARgBSAEkAQwBBAGQAYQB3AGkAZQAuAHAAcg
>> BlAHQAbwByAGkAdQBzAEQAQQBXAEkARQBQAC0ATABUACncpJrZCLgCAAAAAAAAAAAAAAA
>> AAAAAAOpZoYZfwwoauJ0u1F2AVKjAm/c35ZRlVw==
>>
>> The HTTP Response message received from the contacted server could not be understood or was otherwise malformed. Please contact the site operator.
>>
>> Your cache administrator may be able to provide you with more details about the exact nature of the problem if needed.
>>
>> Your cache administrator is webmaster.
>>
>> Generated Wed, 20 Jan 2010 08:19:13 GMT by XXXXXXXXXXXXX
>> (squid/3.1.0.15)
>>
>> Is this something in squid causing this? Or is this something on the network?
> > If you are not getting this errors, then this has to be something
> on my side?
>
> I'm not sure at this point.
> There is no indication yet what error Squid thinks exists in the reply.
>
> Comparing the two error pages it looks like 3.0 was barfing on the
> Cookie. 3.1 seems to find something else.
>
> I'm adding some debug to Squid permanently that should help track
> these down in future.
>
> Meanwhile can you add debug_options 11,9 to your squid.conf and run a
> test please. The resulting cache.log file will have a lot of garbage,
> but amongst that some messages about what headers were received back
> and what happened in the processing.
>
> Amos


--
Please be using
   Current Stable Squid 2.7.STABLE7 or 3.0.STABLE21
   Current Beta Squid 3.1.0.15
Received on Wed Jan 27 2010 - 10:29:07 MST