Quantcast

Logs to confirm packets dropped/not forwarded by squid

Previous Topic Next Topic
 
classic Classic list List threaded Threaded
8 messages Options
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Logs to confirm packets dropped/not forwarded by squid

Anonymous cross
Hi,
Is there any way to find out the packets dropped/not forwarded by squid?
Is there any debug logs/option to enable it?


Regards,
Anonymous cross.

_______________________________________________
squid-users mailing list
[hidden email]
http://lists.squid-cache.org/listinfo/squid-users
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Logs to confirm packets dropped/not forwarded by squid

Matus UHLAR - fantomas
On 06.02.17 10:47, Anonymous cross wrote:
>Is there any way to find out the packets dropped/not forwarded by squid?
>Is there any debug logs/option to enable it?

squid does not work with packets. It works with connections.

--
Matus UHLAR - fantomas, [hidden email] ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Linux IS user friendly, it's just selective who its friends are...
_______________________________________________
squid-users mailing list
[hidden email]
http://lists.squid-cache.org/listinfo/squid-users
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Logs to confirm packets dropped/not forwarded by squid

Anonymous cross
 Is there any way to find the connections dropped/not forwarded by Squid? I could see HTTP GET is forwarded to squid but it's not initiating a connection with webserver

On Mon, Feb 6, 2017 at 10:54 AM, Matus UHLAR - fantomas <[hidden email]> wrote:
On 06.02.17 10:47, Anonymous cross wrote:
Is there any way to find out the packets dropped/not forwarded by squid?
Is there any debug logs/option to enable it?

squid does not work with packets. It works with connections.

--
Matus UHLAR - fantomas, [hidden email] ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Linux IS user friendly, it's just selective who its friends are...
_______________________________________________
squid-users mailing list
[hidden email]
http://lists.squid-cache.org/listinfo/squid-users



--
Regards,
Anonymous cross.

_______________________________________________
squid-users mailing list
[hidden email]
http://lists.squid-cache.org/listinfo/squid-users
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Logs to confirm packets dropped/not forwarded by squid

Antony Stone
On Monday 06 Feb 2017 at 17:26, Anonymous cross wrote:

>  Is there any way to find the connections dropped/not forwarded by Squid? I
> could see HTTP GET is forwarded to squid but it's not initiating a
> connection with webserver

Have you looked in access.log for that connection?


Antony.

--
Bill Gates has personally assured the Spanish Academy that he will never allow
the upside-down question mark to disappear from Microsoft word-processing
programs, which must be reassuring for millions of Spanish-speaking people,
though just a piddling afterthought as far as he's concerned.

 - Lynne Truss, "Eats, Shoots and Leaves"

                                                   Please reply to the list;
                                                         please *don't* CC me.
_______________________________________________
squid-users mailing list
[hidden email]
http://lists.squid-cache.org/listinfo/squid-users
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Logs to confirm packets dropped/not forwarded by squid

Anonymous cross
I don't find any entry in access.log for that connection.


Regards,
Saravanan N

On Mon, Feb 6, 2017 at 11:29 AM, Antony Stone <[hidden email]> wrote:
On Monday 06 Feb 2017 at 17:26, Anonymous cross wrote:

>  Is there any way to find the connections dropped/not forwarded by Squid? I
> could see HTTP GET is forwarded to squid but it's not initiating a
> connection with webserver

Have you looked in access.log for that connection?


Antony.

--
Bill Gates has personally assured the Spanish Academy that he will never allow
the upside-down question mark to disappear from Microsoft word-processing
programs, which must be reassuring for millions of Spanish-speaking people,
though just a piddling afterthought as far as he's concerned.

 - Lynne Truss, "Eats, Shoots and Leaves"

                                                   Please reply to the list;
                                                         please *don't* CC me.
_______________________________________________
squid-users mailing list
[hidden email]
http://lists.squid-cache.org/listinfo/squid-users



--
Regards,
Anonymous cross.

_______________________________________________
squid-users mailing list
[hidden email]
http://lists.squid-cache.org/listinfo/squid-users
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Logs to confirm packets dropped/not forwarded by squid

Antony Stone
On Monday 06 Feb 2017 at 17:34, Anonymous cross wrote:

> I don't find any entry in access.log for that connection.

Okay, maybe you should explain a little more about what you mean by "I could
see HTTP GET is forwarded to Squid" - does "forwarded" mean you're using
intercept mode, and if it does, how are you forwarding the packets to Squid?

How did you "see the HTTP GET", and where were you looking for it?


Antony.

--
Wanted: telepath.   You know where to apply.

                                                   Please reply to the list;
                                                         please *don't* CC me.
_______________________________________________
squid-users mailing list
[hidden email]
http://lists.squid-cache.org/listinfo/squid-users
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Logs to confirm packets dropped/not forwarded by squid

Anonymous cross
We are using squid with tproxy4. All the packets destined to port 80 are forwarded to tproxy port 3129 using the below guide

http://wiki.squid-cache.org/Features/Tproxy4

Normal HTTP GET requests forwarded to Squid are working fine. But we do see problems with TCP segments which holds HTTP data. I am not sure how squid TCP reassembly logic works. I need some way to find out where it's getting dropped in squid.



On Mon, Feb 6, 2017 at 11:45 AM, Antony Stone <[hidden email]> wrote:
On Monday 06 Feb 2017 at 17:34, Anonymous cross wrote:

> I don't find any entry in access.log for that connection.

Okay, maybe you should explain a little more about what you mean by "I could
see HTTP GET is forwarded to Squid" - does "forwarded" mean you're using
intercept mode, and if it does, how are you forwarding the packets to Squid?

How did you "see the HTTP GET", and where were you looking for it?


Antony.

--
Wanted: telepath.   You know where to apply.

                                                   Please reply to the list;
                                                         please *don't* CC me.
_______________________________________________
squid-users mailing list
[hidden email]
http://lists.squid-cache.org/listinfo/squid-users



--
Regards,
Anonymous cross.

_______________________________________________
squid-users mailing list
[hidden email]
http://lists.squid-cache.org/listinfo/squid-users
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Logs to confirm packets dropped/not forwarded by squid

Amos Jeffries
Administrator
On 7/02/2017 7:04 a.m., Anonymous cross wrote:
> We are using squid with tproxy4. All the packets destined to port 80 are
> forwarded to tproxy port 3129 using the below guide
>
> http://wiki.squid-cache.org/Features/Tproxy4
>
> Normal HTTP GET requests forwarded to Squid are working fine. But we do see
> problems with TCP segments which holds HTTP data. I am not sure how squid
> TCP reassembly logic works. I need some way to find out where it's getting
> dropped in squid.

As Matus said; Squid does not do any TCP level packet handling. That is
all done in the networking stack, same as for any other program.

TPROXY only affects the TCP accept() logic related to the TCP SYN
packet. Once that is over it is just a regular network socket I/O. Squid
uses the system read() for as much data as it can get. Then parses HTTP
messages out of the received data.

With "debug_options 11,2" configured Squid will log to cache.log all the
messages it is handling an the connection they occured on.


PS. Squid-4 logs to access.log connections which were received and
terminated or had errors before the HTTP message was received. Squid-3
just lets those connections die quietly.

HTH
Amos

_______________________________________________
squid-users mailing list
[hidden email]
http://lists.squid-cache.org/listinfo/squid-users
Loading...