Re: squid input more than output?

Vincent Tsang wrote:

> What does it mean when a dedicated proxy server has a lot more input than
> output (it shows on the mrtg graphs), and it only happens at certain time of
> the day which looks like a user pattern, is it a misconfig or security
> breach?

Probably a bug or misfeature.

There are a couple of known cases where this may happen:

a) Range requests to servers not supporting Range requests.

b) quick_abort failing on certain malformed server replies.

c) HEAD requests to FTP objects not yet in the cache

For (a) and (c) there is a patches on my Squid patches page.

For (b) i'd recommend the setting
  quick_abort_min 0
  quick_abort_max 0

--
Henrik Nordstrom
Squid hacker
http://hem.passagen.se/hno/squid/