Re: [squid-users] ISP-style Transparent Proxy

From: Kevin Wilcox <kevin.wilcox_at_gmail.com>
Date: Wed, 7 Nov 2012 17:41:38 -0500

On 7 November 2012 17:35, Nick Bright <nick.bright_at_valnet.net> wrote:

> On the web server that should be receiving the hit, tcpdump reports:
>
> 16:31:21.283309 IP 64.254.49.2.33315 > 64.254.32.23.http: Flags [S], seq
> 4294319084, win 14600, options [mss 1460,sackOK,TS val 11023544 ecr
> 0,nop,wscale 7], length 0
> 16:31:21.283415 IP 64.254.32.23.http > 64.254.49.2.33315: Flags [S.], seq
> 2198086634, ack 4294319085, win 14480, options [mss 1460,sackOK,TS val
> 2023464600 ecr 11023544,nop,wscale 7], length 0
> 16:31:22.282510 IP 64.254.32.23.http > 64.254.49.2.33315: Flags [S.], seq
> 2198086634, ack 4294319085, win 14480, options [mss 1460,sackOK,TS val
> 2023465600 ecr 11023544,nop,wscale 7], length 0
>
> (this repeats several times, in what I would presume are browser retries)

At any point do you get

<timestamp> IP 64.254.49.2.33315 > 64.253.32.23.http: Flags [.] <rest of line>

It looks like no return ACK is being sent from the client, without the
3WHS you're never going to see a connection in the Apache logs.

kmw
Received on Wed Nov 07 2012 - 22:41:44 MST

This archive was generated by hypermail 2.2.0 : Thu Nov 08 2012 - 12:00:03 MST