Re: [squid-users] Strange entries from my log

On 18/10/2013 1:47 a.m., Ralf Hildebrandt wrote:
> * Ralf Hildebrandt <Ralf.Hildebrandt_at_charite.de>:
>> * Ralf Hildebrandt <Ralf.Hildebrandt_at_charite.de>:
>>
>>> 2013/10/15 10:49:59| internalStart: unknown request: GET /squid-internal-static/icons/silk/arrow_up.png HTTP/1.1
>>> Host: 83.172.xx.xx
>>> User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0)
>>> Gecko/20100101 Firefox/24.0
>>> Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
>>> Accept-Language: en-US,en;q=0.5
>>> Accept-Encoding: gzip, deflate
>>> Connection: keep-alive
>> 83.172.xx.xx corresponds to proxied ftp:// connections, and squid
>> probably adds the icons:
>>
>> 1381827085.634 767 192.168.x.x TCP_MISS/200 9661 GET ftp://83.172.xx.xx/AiDisk_a1/Videos/Filmer/Osedda/ - HIER_DIRECT/83.172.xx.xx text/html
> But why would a proxied ftp connection cause these requests?
> Generating the icons is ok, but "Host: 83.172.xx.xx" is not actively
> quering our squid, but 192.168.x.x -- of 127.0.0.1 if squid it
> generating/ adding the icons.

The above ftp:// URL is a directory listing (ends with /). The HTML view
of that directory is generated by Squid and references to Squids'
internal icons for all the embeded graphics based on the FTP directories
/etc/squid/mime.conf URI mappings. Each icon URL on the page goes to
either the relative-URL /squid-internal-static/icons/silk/... or the
full-URL http://$visible_hostname/squid-internal-static/icons/silk/...
depending on the short_icon_urls directive.
When short_icon_urls is set to ON (default) the relative-URLs are used
and the client browser will fetch
http://83.172.xx.xx/squid-internal-static/icons/silk/arrow_up.png etc.
Squid identifies the well-known URL segment /squid-internal-static/ and
sends back its icons/silk/arrow_ip.png file.

I'm not sure yet why its saying "unknown request" for you. Do you have
the silk icons installed by Squid?

Amos
Received on Thu Oct 17 2013 - 23:30:23 MDT