RE: [squid-users] Problem with cache poisoning

>
>
> Hi, I'm having the exact same problem that was discussed (briefly) on
> this list back in December
> (http://www.mail-archive.com/squid-users@squid-cache.org/msg11
> 526.html)
> except that I'm running on Solaris, and not Linux.
> I can't find anything in the archives other than the first mail, and
> some requests for mor information.
>
> To the original poster (vikram mohite) or anyone else for that matter,
> did you ever figure out what was going on, or was this just
> one of thos
> problems tat disappeared by itself?
>

 I never had this but I would suggest finding out whether you
are dealing with cache poisoning or perhaps 'browser poisoning' due
to cookie fiddling or whatever due to earlier visit of a malicious site.
This could easily be done by querying the cache directly for the
affected sites as in :

   % telnet squid_host squid_port
   GET http://www.rediff.com/ HTTP/1.0
   <double return>

Verify this output and see whether this is rediff.com or 'coolsavings'.

Verify also, what is seen in access.log when trying this request.
Preferably I would do this, in such cases in an 'isolated mode' on squid, meaning
that squid is not dealing with other requests, to have a clear analysis of
this problem.

M.

 
Received on Mon Jan 19 2004 - 05:03:56 MST