Re: Cache index mangled?

At 11:03 AM 11/5/97 +1000, Bruce Campbell wrote:
>On Wed, 5 Nov 1997, Dancer wrote:
>
>> Semi-amusing situation. One of our internal web-sites got a bit of a
>> shock. They accessed the page via the proxy and got a porn site instead.
>>
>> This is probably an anomalous occurance, rather than a bug. I'm curious
>> if anyone's seen anything resembling it before, though.
>
>two or three times now I've had to nuke the cache because too many URLs
>were returning porn through the cache (even after a sane restart of
>squid). And when our homepage does that.. .*shudder*
>
>on all occasions I couldn't see anything out of the ordinary in any
>logfiles...

I had a similar problem it seems.

I'm secondary DNS for a friend of mine. I actually do all the DNS
maintenance as well. Some ppl tried to access HIS site, and got mine instead!

I have a feeling this might be something similar, cos all the DNS info
checks out. Could it be bind on the cache machine has "crashed" in some
inexpicable way, and is simply returning weird data to requests, which are
then cached?

I know bind used to die in versions 4.9.3 and 4.9.4 (under linux) and
they'd sit there in memory not answering requests at all.., yet you could
SIGHUP it to reload the data, and it'd do that fine, just not answer any
requests.

Question remains also, is it just random records, or is it specific
records? ie: accesses to my friends site must have returned the last NS
record in the zone, and then done a lookup on that (thought it was a
CNAME?). I wonder how many secondary name servers are porn sites *grin*.

-=[ Stuart Young (Aka Cefiar) ]=--------------------------------------
| http://amarok.glasswings.com.au/ | [email protected] |
----------------------------------------------------------------------
| Jake and Elwood - The Blues Brothers! |
| "You traded it?! You traded the Blues Mobile for this?" |
| "No. For a microphone." "A microphone? OK I can see that." |
Received on Fri Nov 07 1997 - 20:27:17 MST