Re: strange LOG_NONE requests

Duane Wessels wrote:
>
>cb@brewhq.swb.de writes:
>
>>>> With the new cachemgr.cgi that comes with 1.1beta, it's reminded
>>>> me to ask about the strange IP addresses that attempt to request
>>>> LOG_NONE. Some of them I can probably account for since my proxy is
>>>> 'announced' (but firmly acl'ed) as they are routable. Others, however,
>>>> include:
>>>> 67.1.0.0
>>>> 170.50.0.0
>>>> 0.4.0.0
>>>
>>[...]
>>>Pardon my ignorance, but what am I looking at here, and why is this from
>>>both end-users (clients), and from peer proxies?
>>>
>>Yup, I'd like to know that as well (seeing such entries from
>>routable and non-routable or non-reachable address). Esp. since the
>>Squid here is also ACL'ed against accesses from outside the domain...
>
>LOG_NONE means that someone connected to the HTTP port, but did not
>make any sort of HTTP request. I.e. you get this if you make a connection
>and then disconnect it immediately.
>
OK, kinda makes sense with that name. ;-)

>I have no idea why the IP numbers are goofy. They're simply taken
>from the sockaddr return parameter of the accept() call.
>
It's really strange, esp. as I wonder if these are appearing in the
log, would they be able to actually access the proxy?

Dewa,

<CB>

-- 
  // <CB> aka Christian Balzer, Tannenstr. 23c, D-64342 Seeheim, Germany
\X/  CB@brewhq.swb.de | Voice: +49 6257 83036, Fax/Data: +49 6257 83037
SWB  - The Software Brewery - | Team H, Germany HQ | Anime no Otaku