Re: [squid-users] strange lines in cache.log

tis 2007-06-12 klockan 11:21 +0500 skrev rihad:
> Our Squid has long been constantly putting some strange lines in cache.log:
>
> 2007/06/12 11:15:45| parseHttpRequest: Requestheader contains NULL
> characters
> 2007/06/12 11:15:45| parseHttpRequest: Unsupported method '^C'
> 2007/06/12 11:15:45| clientReadRequest: FD 930 (x.x.x.x:2649) Invalid
> Request
> 2007/06/12 11:15:45| parseHttpRequest: Requestheader contains NULL
> characters
> 2007/06/12 11:15:45| parseHttpRequest: Unsupported method '^C'
> 2007/06/12 11:15:45| clientReadRequest: FD 145 (x.x.x.x:62332) Invalid
> Request
> 2007/06/12 11:15:48| parseHttpRequest: Requestheader contains NULL
> characters
> 2007/06/12 11:15:48| parseHttpRequest: Unsupported method '^C'
> 2007/06/12 11:15:48| clientReadRequest: FD 1611 (x.x.x.x:60853) Invalid
> Request
> 2007/06/12 11:15:49| parseHttpRequest: Requestheader contains NULL
> characters
> 2007/06/12 11:15:49| parseHttpRequest: Unsupported method '^C'
>
>
> ad nauseum (the IP addresses need not be the same) at a rate of 30-40
> megs a day. Does someone know what the reason could be, even if it's
> unrelated to Squid (I'm not sure)? Thanks.

Please use ethereal/wireshark to capture one or two of these.

1. Start wireshart, and start a new packet capture.

2. When seeing the error in cache.log, enter the filter
  ip.address == YYYYYY && tcp.port == XXXXX

where YYYYY is the IP and XXXXX is the port number from the Invalid
Request log line.

Then select the first packet shown (should be a SYN), and choose Analyze
-> Follow TCP Stream. This opens a new window with the TCP stream
decoded.

What do you get?

Regards
Henrik