Re: [squid-users] Squid vs MSN Again!

>How does it look like in tcpdump (on both sides of squid box)?

I ran a tcpdump from my workstation to dst host squid server and on the
squid server using a src host as my workstation. I am not sure about what I
should specifically be looking for so I have pasted the output of the dump
below (I hope that is ok). The connection to msn lasted around 11min before
disconnecting but during that time some of the messages didn't get to the
intended recipriant:

My workstation output:

tcpdump dst host squid_proxy -i eth0 > /home/ryans/tcpdump-msn
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes

12:43:23.599209 IP Merlin.33004 > squid_proxy.webcache: S
3017184069:3017184069(0) win 5840 <mss 1460,sackOK,timestamp 6382236
0,nop,wscale 0>
12:43:23.601275 IP Merlin.33004 > squid_proxy.webcache: . ack 3561300204 win
5840 <nop,nop,timestamp 6382237 577089857>
12:43:23.600535 IP Merlin.33004 > squid_proxy.webcache: P 0:357(357) ack 1
win 5840 <nop,nop,timestamp 6382240 577089857>
12:43:23.943315 IP Merlin.33004 > squid_proxy.webcache: . ack 287 win 6432
<nop,nop,timestamp 6382583 577089891>
12:43:23.944445 IP Merlin.33004 > squid_proxy.webcache: P 357:688(331) ack
287 win 6432 <nop,nop,timestamp 6382584 577089891>
12:43:24.339535 IP Merlin.33004 > squid_proxy.webcache: . ack 573 win 7504
<nop,nop,timestamp 6382980 577089927>
12:43:24.545954 IP Merlin.33004 > squid_proxy.webcache: . ack 598 win 7504
<nop,nop,timestamp 6383186 577089952>
12:43:24.557856 IP Merlin.33004 > squid_proxy.webcache: P 688:1070(382) ack
598 win 7504 <nop,nop,timestamp 6383198 577089952>
12:43:24.898451 IP Merlin.33004 > squid_proxy.webcache: . ack 884 win 8576
<nop,nop,timestamp 6383539 577089983>
12:43:25.104496 IP Merlin.33004 > squid_proxy.webcache: . ack 1038 win 8576
<nop,nop,timestamp 6383745 577090008>
12:43:25.105471 IP Merlin.33004 > squid_proxy.webcache: P 1070:1411(341) ack
1038 win 8576 <nop,nop,timestamp 6383746 577090008>
12:43:25.486366 IP Merlin.33004 > squid_proxy.webcache: . ack 1326 win 8576
<nop,nop,timestamp 6384127 577090042>
12:43:25.693022 IP Merlin.33004 > squid_proxy.webcache: . ack 1481 win 8576
<nop,nop,timestamp 6384333 577090066>
12:43:25.711202 IP Merlin.33005 > squid_proxy.webcache: S
3017401582:3017401582(0) win 5840 <mss 1460,sackOK,timestamp 6384351
0,nop,wscale 0>
12:43:25.711996 IP Merlin.33005 > squid_proxy.webcache: . ack 3721638304 win
5840 <nop,nop,timestamp 6384352 577090068>
12:43:25.712189 IP Merlin.33005 > squid_proxy.webcache: P 0:402(402) ack 1
win 5840 <nop,nop,timestamp 6384352 577090068>
12:43:26.027694 IP Merlin.33005 > squid_proxy.webcache: . ack 479 win 6432
<nop,nop,timestamp 6384668 577090100>
12:43:26.028992 IP Merlin.33005 > squid_proxy.webcache: F 402:402(0) ack 480
win 6432 <nop,nop,timestamp 6384669 577090100>
12:43:26.029870 IP Merlin.33006 > squid_proxy.webcache: S
3012287195:3012287195(0) win 5840 <mss 1460,sackOK,timestamp 6384670
0,nop,wscale 0>
12:43:26.030544 IP Merlin.33006 > squid_proxy.webcache: . ack 3813868584 win
5840 <nop,nop,timestamp 6384671 577090100>
12:43:26.030717 IP Merlin.33006 > squid_proxy.webcache: P 0:416(416) ack 1
win 5840 <nop,nop,timestamp 6384671 577090100>
12:43:26.366871 IP Merlin.33006 > squid_proxy.webcache: . ack 1449 win 8688
<nop,nop,timestamp 6385007 577090134>
12:43:26.366883 IP Merlin.33006 > squid_proxy.webcache: . ack 1681 win 8688
<nop,nop,timestamp 6385007 577090134>
12:43:26.368789 IP Merlin.33006 > squid_proxy.webcache: F 416:416(0) ack
1682 win 8688 <nop,nop,timestamp 6385009 577090134>
12:43:26.369486 IP Merlin.33004 > squid_proxy.webcache: P 1411:2022(611) ack
1481 win 8576 <nop,nop,timestamp 6385010 577090066>
12:43:26.724169 IP Merlin.33004 > squid_proxy.webcache: . ack 1768 win 8576
<nop,nop,timestamp 6385364 577090170>
12:43:27.001129 IP Merlin.33004 > squid_proxy.webcache: . ack 1824 win 8576
<nop,nop,timestamp 6385641 577090197>
12:43:27.178022 IP Merlin.33004 > squid_proxy.webcache: P 2022:2339(317) ack
1824 win 8576 <nop,nop,timestamp 6385818 577090197>
12:43:27.482832 IP Merlin.33004 > squid_proxy.webcache: . ack 2111 win 8576
<nop,nop,timestamp 6386123 577090245>
12:43:27.637116 IP Merlin.33004 > squid_proxy.webcache: . ack 2589 win 9648
<nop,nop,timestamp 6386278 577090261>
12:43:32.638445 IP Merlin.33004 > squid_proxy.webcache: P 2339:2655(316) ack
2589 win 9648 <nop,nop,timestamp 6391280 577090261>
12:43:32.949454 IP Merlin.33004 > squid_proxy.webcache: . ack 3402 win 11382
<nop,nop,timestamp 6391591 577090792>
12:43:33.100622 IP Merlin.33004 > squid_proxy.webcache: . ack 3926 win 13008
<nop,nop,timestamp 6391742 577090807>
12:43:33.102983 IP Merlin.33004 > squid_proxy.webcache: . ack 4974 win 14672
<nop,nop,timestamp 6391744 577090807>
12:43:33.253281 IP Merlin.33004 > squid_proxy.webcache: . ack 5591 win 16768
<nop,nop,timestamp 6391895 577090822>
12:43:33.329332 IP Merlin.33004 > squid_proxy.webcache: P 2655:3238(583) ack
5591 win 16768 <nop,nop,timestamp 6391971 577090822>
12:43:33.657173 IP Merlin.33004 > squid_proxy.webcache: . ack 5879 win 16768
<nop,nop,timestamp 6392299 577090863>
12:43:33.937747 IP Merlin.33004 > squid_proxy.webcache: . ack 6155 win 16768
<nop,nop,timestamp 6392579 577090891>
12:43:38.938456 IP Merlin.33004 > squid_proxy.webcache: P 3238:3555(317) ack
6155 win 16768 <nop,nop,timestamp 6397581 577090891>
12:44:34.243582 IP Merlin.33004 > squid_proxy.webcache: F 3555:3555(0) ack
6155 win 16768 <nop,nop,timestamp 6452894 577091401>
12:44:35.735059 IP Merlin.33008 > squid_proxy.webcache: S
3084815445:3084815445(0) win 5840 <mss 1460,sackOK,timestamp 6454386
0,nop,wscale 0>
12:44:35.735747 IP Merlin.33008 > squid_proxy.webcache: . ack 3352060136 win
5840 <nop,nop,timestamp 6454387 577097071>
12:44:35.738750 IP Merlin.33008 > squid_proxy.webcache: P 0:357(357) ack 1
win 5840 <nop,nop,timestamp 6454390 577097071>
12:44:36.065188 IP Merlin.33008 > squid_proxy.webcache: . ack 286 win 6432
<nop,nop,timestamp 6454716 577097104>
12:44:36.066299 IP Merlin.33008 > squid_proxy.webcache: P 357:692(335) ack
286 win 6432 <nop,nop,timestamp 6454717 577097104>
12:44:36.423580 IP Merlin.33008 > squid_proxy.webcache: . ack 586 win 7504
<nop,nop,timestamp 6455075 577097135>
12:44:41.384992 IP Merlin.33008 > squid_proxy.webcache: P 692:1008(316) ack
586 win 7504 <nop,nop,timestamp 6460037 577097135>
12:44:41.687467 IP Merlin.33008 > squid_proxy.webcache: . ack 847 win 8576
<nop,nop,timestamp 6460339 577097666>
12:44:41.687995 IP Merlin.33008 > squid_proxy.webcache: F 1008:1008(0) ack
847 win 8576 <nop,nop,timestamp 6460340 577097666>
12:44:41.689464 IP Merlin.33008 > squid_proxy.webcache: . ack 848 win 8576
<nop,nop,timestamp 6460341 577097666>
12:44:48.745435 IP Merlin.33009 > squid_proxy.webcache: S
3101154330:3101154330(0) win 5840 <mss 1460,sackOK,timestamp 6467398
0,nop,wscale 0>
12:44:48.746137 IP Merlin.33009 > squid_proxy.webcache: . ack 2546294730 win
5840 <nop,nop,timestamp 6467399 577098372>
12:44:48.749104 IP Merlin.33009 > squid_proxy.webcache: P 0:357(357) ack 1
win 5840 <nop,nop,timestamp 6467402 577098372>
12:44:49.093192 IP Merlin.33009 > squid_proxy.webcache: . ack 286 win 6432
<nop,nop,timestamp 6467746 577098406>
12:44:49.094377 IP Merlin.33009 > squid_proxy.webcache: P 357:687(330) ack
286 win 6432 <nop,nop,timestamp 6467747 577098406>
12:44:49.436602 IP Merlin.33009 > squid_proxy.webcache: . ack 572 win 7504
<nop,nop,timestamp 6468090 577098437>
12:44:49.641494 IP Merlin.33009 > squid_proxy.webcache: . ack 597 win 7504
<nop,nop,timestamp 6468294 577098461>
12:44:49.642403 IP Merlin.33009 > squid_proxy.webcache: P 687:1069(382) ack
597 win 7504 <nop,nop,timestamp 6468295 577098461>
12:44:49.982517 IP Merlin.33009 > squid_proxy.webcache: . ack 884 win 8576
<nop,nop,timestamp 6468636 577098491>
12:44:50.183420 IP Merlin.33009 > squid_proxy.webcache: . ack 1038 win 8576
<nop,nop,timestamp 6468836 577098515>
12:44:50.184430 IP Merlin.33009 > squid_proxy.webcache: P 1069:1411(342) ack
1038 win 8576 <nop,nop,timestamp 6468837 577098515>
12:44:50.536431 IP Merlin.33009 > squid_proxy.webcache: . ack 1325 win 8576
<nop,nop,timestamp 6469190 577098547>
12:44:50.744087 IP Merlin.33009 > squid_proxy.webcache: . ack 1480 win 8576
<nop,nop,timestamp 6469397 577098571>
12:44:50.764787 IP Merlin.33010 > squid_proxy.webcache: S
3104426775:3104426775(0) win 5840 <mss 1460,sackOK,timestamp 6469418
0,nop,wscale 0>
12:44:50.765564 IP Merlin.33010 > squid_proxy.webcache: . ack 2491038085 win
5840 <nop,nop,timestamp 6469419 577098574>
12:44:50.766410 IP Merlin.33010 > squid_proxy.webcache: P 0:402(402) ack 1
win 5840 <nop,nop,timestamp 6469420 577098574>
12:44:51.066015 IP Merlin.33010 > squid_proxy.webcache: . ack 479 win 6432
<nop,nop,timestamp 6469719 577098604>
12:44:51.067322 IP Merlin.33010 > squid_proxy.webcache: F 402:402(0) ack 480
win 6432 <nop,nop,timestamp 6469720 577098604>
12:44:51.068195 IP Merlin.33011 > squid_proxy.webcache: S
3098387147:3098387147(0) win 5840 <mss 1460,sackOK,timestamp 6469721
0,nop,wscale 0>
12:44:51.068865 IP Merlin.33011 > squid_proxy.webcache: . ack 2998684503 win
5840 <nop,nop,timestamp 6469722 577098604>
12:44:51.069030 IP Merlin.33011 > squid_proxy.webcache: P 0:416(416) ack 1
win 5840 <nop,nop,timestamp 6469722 577098604>
12:44:51.430178 IP Merlin.33011 > squid_proxy.webcache: . ack 1449 win 8688
<nop,nop,timestamp 6470083 577098640>
12:44:51.430189 IP Merlin.33011 > squid_proxy.webcache: . ack 1681 win 8688
<nop,nop,timestamp 6470083 577098640>
12:44:51.432124 IP Merlin.33011 > squid_proxy.webcache: F 416:416(0) ack
1682 win 8688 <nop,nop,timestamp 6470085 577098640>
12:44:51.432821 IP Merlin.33009 > squid_proxy.webcache: P 1411:2021(610) ack
1480 win 8576 <nop,nop,timestamp 6470086 577098571>
12:45:39.460631 IP Merlin.33009 > squid_proxy.webcache: . ack 2928 win 11584
<nop,nop,timestamp 6518121 577103443>
12:45:39.461158 IP Merlin.33009 > squid_proxy.webcache: F 2021:2021(0) ack
2928 win 11584 <nop,nop,timestamp 6518122 577103443>
12:45:39.461357 IP Merlin.33009 > squid_proxy.webcache: R
3101156352:3101156352(0) win 0
12:45:39.461840 IP Merlin.33009 > squid_proxy.webcache: R
3101156353:3101156353(0) win 0
12:45:39.462089 IP Merlin.33009 > squid_proxy.webcache: R
3101156353:3101156353(0) win 0
12:46:28.809386 IP Merlin.33015 > squid_proxy.webcache: S
3200021947:3200021947(0) win 5840 <mss 1460,sackOK,timestamp 6567477
0,nop,wscale 0>
12:46:28.810151 IP Merlin.33015 > squid_proxy.webcache: . ack 800202351 win
5840 <nop,nop,timestamp 6567478 577108378>
12:46:28.814796 IP Merlin.33015 > squid_proxy.webcache: P 0:357(357) ack 1
win 5840 <nop,nop,timestamp 6567483 577108378>
12:46:29.159082 IP Merlin.33015 > squid_proxy.webcache: . ack 284 win 6432
<nop,nop,timestamp 6567827 577108413>
12:46:29.161104 IP Merlin.33015 > squid_proxy.webcache: P 357:684(327) ack
284 win 6432 <nop,nop,timestamp 6567829 577108413>
12:46:29.505387 IP Merlin.33015 > squid_proxy.webcache: . ack 567 win 7504
<nop,nop,timestamp 6568174 577108443>
12:46:29.703880 IP Merlin.33015 > squid_proxy.webcache: . ack 591 win 7504
<nop,nop,timestamp 6568372 577108467>
12:46:29.705180 IP Merlin.33015 > squid_proxy.webcache: P 684:1062(378) ack
591 win 7504 <nop,nop,timestamp 6568373 577108467>
12:46:30.054304 IP Merlin.33015 > squid_proxy.webcache: . ack 876 win 8576
<nop,nop,timestamp 6568723 577108498>
12:46:30.288908 IP Merlin.33015 > squid_proxy.webcache: . ack 1029 win 8576
<nop,nop,timestamp 6568957 577108526>
12:46:30.304207 IP Merlin.33015 > squid_proxy.webcache: P 1062:1401(339) ack
1029 win 8576 <nop,nop,timestamp 6568972 577108526>
12:46:30.686208 IP Merlin.33015 > squid_proxy.webcache: . ack 1314 win 8576
<nop,nop,timestamp 6569355 577108562>
12:46:30.886677 IP Merlin.33015 > squid_proxy.webcache: . ack 1468 win 8576
<nop,nop,timestamp 6569555 577108586>
12:46:30.888356 IP Merlin.33016 > squid_proxy.webcache: S
3198342401:3198342401(0) win 5840 <mss 1460,sackOK,timestamp 6569557
0,nop,wscale 0>
12:46:30.889031 IP Merlin.33016 > squid_proxy.webcache: . ack 377114519 win
5840 <nop,nop,timestamp 6569557 577108586>
12:46:30.889222 IP Merlin.33016 > squid_proxy.webcache: P 0:402(402) ack 1
win 5840 <nop,nop,timestamp 6569558 577108586>
12:46:31.242349 IP Merlin.33016 > squid_proxy.webcache: . ack 479 win 6432
<nop,nop,timestamp 6569911 577108621>
12:46:31.257642 IP Merlin.33016 > squid_proxy.webcache: F 402:402(0) ack 480
win 6432 <nop,nop,timestamp 6569926 577108621>
12:46:31.258972 IP Merlin.33017 > squid_proxy.webcache: S
3195794182:3195794182(0) win 5840 <mss 1460,sackOK,timestamp 6569927
0,nop,wscale 0>
12:46:31.260185 IP Merlin.33017 > squid_proxy.webcache: . ack 1428808230 win
5840 <nop,nop,timestamp 6569929 577108623>
12:46:31.260371 IP Merlin.33017 > squid_proxy.webcache: P 0:416(416) ack 1
win 5840 <nop,nop,timestamp 6569929 577108623>
12:46:31.601249 IP Merlin.33017 > squid_proxy.webcache: . ack 1449 win 8688
<nop,nop,timestamp 6570270 577108657>
12:46:31.601261 IP Merlin.33017 > squid_proxy.webcache: . ack 1681 win 8688
<nop,nop,timestamp 6570270 577108657>
12:46:31.603090 IP Merlin.33017 > squid_proxy.webcache: F 416:416(0) ack
1682 win 8688 <nop,nop,timestamp 6570272 577108657>
12:46:31.603801 IP Merlin.33015 > squid_proxy.webcache: P 1401:2008(607) ack
1468 win 8576 <nop,nop,timestamp 6570272 577108586>
12:46:31.970159 IP Merlin.33015 > squid_proxy.webcache: . ack 1751 win 8576
<nop,nop,timestamp 6570639 577108694>
12:46:32.230013 IP Merlin.33015 > squid_proxy.webcache: . ack 1806 win 8576
<nop,nop,timestamp 6570899 577108720>
12:46:32.401827 IP Merlin.33015 > squid_proxy.webcache: P 2008:2320(312) ack
1806 win 8576 <nop,nop,timestamp 6571070 577108720>
12:46:32.874127 IP Merlin.33015 > squid_proxy.webcache: . ack 2091 win 8576
<nop,nop,timestamp 6571543 577108784>
12:46:33.142456 IP Merlin.33015 > squid_proxy.webcache: . ack 2569 win 9648
<nop,nop,timestamp 6571811 577108811>
12:46:38.143389 IP Merlin.33015 > squid_proxy.webcache: P 2320:2634(314) ack
2569 win 9648 <nop,nop,timestamp 6576813 577108811>
12:46:38.442684 IP Merlin.33015 > squid_proxy.webcache: . ack 2854 win 9648
<nop,nop,timestamp 6577112 577109341>
12:46:38.442902 IP Merlin.33015 > squid_proxy.webcache: . ack 3378 win 10720
<nop,nop,timestamp 6577112 577109341>
12:46:38.609968 IP Merlin.33015 > squid_proxy.webcache: . ack 4826 win 13032
<nop,nop,timestamp 6577279 577109358>
12:46:38.609976 IP Merlin.33015 > squid_proxy.webcache: . ack 4950 win 13032
<nop,nop,timestamp 6577279 577109358>
12:46:38.759253 IP Merlin.33015 > squid_proxy.webcache: . ack 5566 win 15928
<nop,nop,timestamp 6577429 577109373>
12:46:38.830747 IP Merlin.33015 > squid_proxy.webcache: P 2634:3212(578) ack
5566 win 15928 <nop,nop,timestamp 6577500 577109373>
12:46:39.167369 IP Merlin.33015 > squid_proxy.webcache: . ack 5850 win 15928
<nop,nop,timestamp 6577837 577109414>
12:46:39.408361 IP Merlin.33015 > squid_proxy.webcache: . ack 6125 win 15928
<nop,nop,timestamp 6578078 577109438>
12:46:44.409289 IP Merlin.33015 > squid_proxy.webcache: P 3212:3525(313) ack
6125 win 15928 <nop,nop,timestamp 6583080 577109438>
12:46:44.719825 IP Merlin.33015 > squid_proxy.webcache: . ack 6411 win 15928
<nop,nop,timestamp 6583390 577109969>
12:46:44.719921 IP Merlin.33015 > squid_proxy.webcache: . ack 6935 win 15928
<nop,nop,timestamp 6583390 577109969>
12:46:44.864743 IP Merlin.33015 > squid_proxy.webcache: . ack 7459 win 16768
<nop,nop,timestamp 6583535 577109983>
12:46:44.864842 IP Merlin.33015 > squid_proxy.webcache: . ack 7983 win 16768
<nop,nop,timestamp 6583535 577109983>
12:46:44.865085 IP Merlin.33015 > squid_proxy.webcache: . ack 8507 win 16768
<nop,nop,timestamp 6583536 577109983>
12:46:45.040388 IP Merlin.33015 > squid_proxy.webcache: . ack 9755 win 18720
<nop,nop,timestamp 6583711 577110001>
12:46:50.042426 IP Merlin.33015 > squid_proxy.webcache: P 3525:3839(314) ack
9755 win 18720 <nop,nop,timestamp 6588714 577110001>
12:49:31.064074 IP Merlin.33004 > squid_proxy.webcache: R
3017187626:3017187626(0) win 0
12:58:21.457656 IP Merlin.33015 > squid_proxy.webcache: . ack 11203 win
21720 <nop,nop,timestamp 7280234 577179641>
12:58:21.458206 IP Merlin.33015 > squid_proxy.webcache: F 3839:3839(0) ack
11203 win 21720 <nop,nop,timestamp 7280235 577179641>
12:58:21.458754 IP Merlin.33015 > squid_proxy.webcache: R
3200025787:3200025787(0) win 0
12:58:21.458990 IP Merlin.33015 > squid_proxy.webcache: R
3200025788:3200025788(0) win 0
12:58:21.459114 IP Merlin.33015 > squid_proxy.webcache: R
3200025788:3200025788(0) win 0

133 packets captured
133 packets received by filter
0 packets dropped by kernel

Server Output:

12:40:21.874474 Merlin.33015 > squid_proxy.8080: P 3525:3839(314) ack 9755
win 18720 <nop,nop,timestamp 6588714 577110001> (DF)
12:43:02.895950 Merlin.33004 > squid_proxy.8080: R 3017187626:3017187626(0)
win 0 (DF)
12:51:53.289814 Merlin.33015 > squid_proxy.8080: . ack 11203 win 21720
<nop,nop,timestamp 7280234 577179641> (DF)
12:51:53.290349 Merlin.33015 > squid_proxy.8080: F 3839:3839(0) ack 11203
win 21720 <nop,nop,timestamp 7280235 577179641> (DF)
12:51:53.290892 Merlin.33015 > squid_proxy.8080: R 3200025787:3200025787(0)
win 0 (DF)
12:51:53.291135 Merlin.33015 > squid_proxy.8080: R 3200025788:3200025788(0)
win 0 (DF)
12:51:53.291249 Merlin.33015 > squid_proxy.8080: R 3200025788:3200025788(0)
win 0 (DF)
13:05:27.804211 Merlin.33022 > squid_proxy.8080: S 489490292:489490292(0)
win 5840 <mss 1460,sackOK,timestamp 8094872 0,nop,wscale 0> (DF)

I hope this helps. I am unfortunately not familiar with tcpdump.
thanks again for the help.

Ryan

>From: Denis Vlasenko <vda@port.imtp.ilyichevsk.odessa.ua>
>To: "Ryan Sclanders" <merlin_rbs@hotmail.com>,squid-users@squid-cache.org
>Subject: Re: [squid-users] Squid vs MSN Again!
>Date: Wed, 23 Jun 2004 14:21:03 +0300
>
>On Wednesday 23 June 2004 14:12, Ryan Sclanders wrote:
> > Hi All,
> >
> > Sorry to post this kind of question again but there seems to be alot of
> > people asking the same question and no real answers. (At least that I
>can
> > find)
> >
> > We are using squid/2.5.STABLE5 in our office. Unfortunately since
>upgrading
> > to this version AMSN or MSN seems to struggle to connect. If we do
>manage
> > to connect it disconnects after an unspecified amount of time. (Usually
> > between 1 and 5 minutes)
>
>How does it look like in tcpdump (on both sides of squid box)?
>--
>vda

_________________________________________________________________
Send text messages from your PC - click to learn more!
http://messenger.msn.co.za?DI=1054&XAPID=2532
Received on Thu Jun 24 2004 - 03:10:53 MDT