RE: [squid-users] Video streaming in some cases not working

I am using SquidGuard with Squid 3.1.14 on Ubuntu and this type of message regarding two slashes is logged by it in the SquidGuard log so it is possible SquidGuard was still running in the testing you performed where you thought you had removed SquidGuard from the configuration.

The log entry is labelled as a warning and I see quite a lot of them in the SquidGuard log on my proxy server.

My guess is SquidGuard is not actually the cause(s) of the problem(s) you are observing if all it is doing is logging these warnings and not actually blocking access.

I visited the site and tried playing a few videos and they appeared to work (not sure what I was selecting though as I don't understand what I assume is Russian :-)). The video seemed slow to start though.
 
I did notice a number of warnings from Internet Explorer 8 regarding "Errors on page" while loading the page in the url you posted.

You may need to do some more in depth investigation (perhaps using tcpdump) to track the tcp and http exchanges between the browser and the web site to understand more about what is going on (or not going on).
 
Regards

Paul

> -----Original Message-----
> From: Amos Jeffries [mailto:squid3_at_treenet.co.nz]
> Sent: Thursday, 15 December 2011 2:21 PM
> To: squid-users_at_squid-cache.org
> Subject: Re: [squid-users] Video streaming in some cases not working
>
> On 14/12/2011 3:06 p.m., Roman Gelfand wrote:
> > No, squidguard doesn't seem to be the problem as when I remove
> > squidguard out of the picture the problem is still there.
> >
> > Any ideas.
> >
> > Thanks
> >
> > On Tue, Dec 13, 2011 at 8:48 PM, Roman Gelfand wrote:
> >> Actually, I didn't see this at first, but it looks like the issue is
> >> with the squidguard. I realize this is not squidguard forum, but if
> >> you know a way to solve this I would appreciate it.
> >>
> >> 2011-12-13 20:38:22 [3699] WARN: Possible bypass attempt. Found
> >> multiple slashes where only one is expected:
> >> http://rb.newsru.com//cgi-
> bin/banner/148?21490&login=echo_214x92&referer=http://www.echo.msk.ru/
>
> This is not a Squid message. Look for whatever is actually producing
> that. Probably some intrusion detection system by the looks of it.
>
> Amos
Received on Thu Dec 15 2011 - 04:03:21 MST