Squid and store.mcafee.com

Hi there,

I've noticed a weird behaviour of squid with request apparently destinated
to McAfee Ecomerce servers (Runing tha crapy IIS thing..)

Some request take muche more bandwidth when going thru squid than directly.
Here's one:

914078866.267 1536 194.38.81.xx TCP_MISS/200 1722 POST http://208.228.228.235/ECom/Pull/EcomPullDLL.dll? - DIRECT/208.228.228.235 application/x-mcafee-ec-1*e45a1e8a-d4cbfc7f-95fa5900

All request concerning this netblock are of the same natuer, ie POST request.

At least letting the 208.228.228.0/24 network going direct rathe tha via
our transproxy setup (2 squid 2.1P2 boxes running Linux 2.0.36 with
fds patch, 512MB RAM, 14.4 GB spooling area each, alteon L4 switch
doing the redirection work) reduce our link usage of 40% (of a 4Mbps link)
when heavy connection are made to this netblock from one single customer
(connected rougly at 500kbit/s)

Snippet from my config:

hierarchy_stoplist cgi-bin ? nph-
acl QUERY urlpath_regex cgi-bin \? \/nph\-
no_cache deny QUERY

quick_abort_min 0 KB
quick_abort_max 100 KB
quick_abort_pct 100

half_closed_clients off

httpd_accel_host virtual
httpd_accel_port 80
httpd_accel_with_proxy on
httpd_accel_uses_host_header on

uri_whitespace allow
persistent_client_posts off

Any idea?

--
Philippe Strauss, ingenieur systeme/reseau, Urbanet SA
philippe.strauss@urbanet.ch
tel +41 21 623 30 20
--