LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 03-30-2009, 04:32 PM   #1
pliqui
Member
 
Registered: Feb 2007
Location: Caracas, Venezuela
Distribution: Debian x64
Posts: 156

Rep: Reputation: 17
Can't See https pages with Squid3


Hello all !

I'm having a little problem with my squid3, i have a develop machine with debian lenny 5 and set up a squid3 proxy to cache the corporate proxy because is to slow, wich means, i connect to my debian box with squid3 and if i dont have the page it looks the parent proxy. Everything works fine less the https pages.

Here is my squid3.conf

Code:
acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl to_localhost dst 127.0.0.0/8

acl SSL_ports  port 443 494 2598
acl Safe_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl CONNECT method CONNECT
#acl http-only port 80

http_access allow manager localhost
http_access deny manager

# Deny requests to unknown ports
http_access deny !Safe_ports

# Deny CONNECT to other than SSL ports
http_access deny CONNECT !SSL_ports

# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS

http_port 3128
icp_port 3130

cache_peer xxx.xxx.xxx.xxx parent 80 3130 no-query login=XXXXX:XXXXX name=isa

#cache_peer_access isa allow http-only

#Default:
# cache_mem 8 MB
  cache_mem 256 MB

#Default:
# maximum_object_size_in_memory 8 KB
  maximum_object_size_in_memory 2048 KB

#Default:
# cache_dir ufs /var/spool/squid3 100 16 256
  cache_dir ufs /var/spool/squid3 5120 16 256

#Default:
# maximum_object_size 4096 KB
  maximum_object_size 51200 KB

refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern (cgi-bin|\?)    0       0%      0
refresh_pattern .               0       20%     4320

#TIMEOUTS
connect_timeout 8 seconds
peer_connect_timeout 3 seconds

#LOGS
coredump_dir /var/spool/squid3
access_log /var/log/squid3/access.log squid
and this is some lines from the access.log when trying to access https pages.

Code:
1238431830.073      0 180.183.66.33 TCP_HIT/301 759 GET http://www.gmail.com/ - NONE/- text/html
1238431830.429    313 180.183.66.33 TCP_MISS/302 1055 GET http://mail.google.com/mail/ - FIRST_UP_PARENT/180.183.193.47 text/html
1238431838.013   7549 180.183.66.33 TCP_MISS/503 0 CONNECT www.google.com:443 - DIRECT/74.125.93.103 -
1238431846.012   7997 180.183.66.33 TCP_MISS/503 0 CONNECT www.google.com:443 - DIRECT/74.125.93.104 -
1238431902.012   7998 180.183.66.33 TCP_MISS/503 0 CONNECT www.google.com:443 - DIRECT/74.125.93.103 -
Any hint, clue, enlightenment will be appreciate !

Thanks in advance
 
Old 03-30-2009, 04:37 PM   #2
anomie
Senior Member
 
Registered: Nov 2004
Location: Texas
Distribution: RHEL, Scientific Linux, Debian, Fedora
Posts: 3,935
Blog Entries: 5

Rep: Reputation: Disabled
squid's access.log entries look OK. How are the https pages "not working"? Are you getting a dialog from squid itself?
 
Old 03-30-2009, 07:49 PM   #3
pliqui
Member
 
Registered: Feb 2007
Location: Caracas, Venezuela
Distribution: Debian x64
Posts: 156

Original Poster
Rep: Reputation: 17
Hello Anomie, and thanks for the reply.

I'm not getting any dialog from squid, simply when i type a https page, the browser start loading for a while then nothing, the page stay blank, pure and simple white screen
 
Old 03-31-2009, 11:11 AM   #4
anomie
Senior Member
 
Registered: Nov 2004
Location: Texas
Distribution: RHEL, Scientific Linux, Debian, Fedora
Posts: 3,935
Blog Entries: 5

Rep: Reputation: Disabled
Are there errors showing up in cache.log?

Also, what browser is this? (Try with different browser // make sure https sites are working without going through a proxy.)
 
Old 04-03-2009, 01:55 PM   #5
pliqui
Member
 
Registered: Feb 2007
Location: Caracas, Venezuela
Distribution: Debian x64
Posts: 156

Original Poster
Rep: Reputation: 17
Hello anomie, I tried with firefox, google chrome and IE8 and nothing, still blank page.

This is my cache.log

Code:
intranet:/var/log/squid3# tailf cache.log
2009/04/03 09:25:05| CACHEMGR: <unknown>@127.0.0.1 requesting 'counters'
2009/04/03 09:30:03| CACHEMGR: <unknown>@127.0.0.1 requesting 'storedir'
2009/04/03 09:30:05| CACHEMGR: <unknown>@127.0.0.1 requesting 'counters'
2009/04/03 09:30:05| CACHEMGR: <unknown>@127.0.0.1 requesting 'counters'
2009/04/03 09:35:03| CACHEMGR: <unknown>@127.0.0.1 requesting 'storedir'
2009/04/03 09:35:05| CACHEMGR: <unknown>@127.0.0.1 requesting 'counters'
2009/04/03 09:35:05| CACHEMGR: <unknown>@127.0.0.1 requesting 'counters'
2009/04/03 09:40:03| CACHEMGR: <unknown>@127.0.0.1 requesting 'storedir'
2009/04/03 09:40:05| CACHEMGR: <unknown>@127.0.0.1 requesting 'counters'
2009/04/03 09:40:05| CACHEMGR: <unknown>@127.0.0.1 requesting 'counters'
2009/04/03 09:45:03| CACHEMGR: <unknown>@127.0.0.1 requesting 'storedir'
2009/04/03 09:45:05| CACHEMGR: <unknown>@127.0.0.1 requesting 'counters'
2009/04/03 09:45:05| CACHEMGR: <unknown>@127.0.0.1 requesting 'counters'
 
Old 04-03-2009, 02:32 PM   #6
anomie
Senior Member
 
Registered: Nov 2004
Location: Texas
Distribution: RHEL, Scientific Linux, Debian, Fedora
Posts: 3,935
Blog Entries: 5

Rep: Reputation: Disabled
I haven't seen the problem you're describing before. I would be curious to see what is happening at the tcp level:

# tcpdump port 443

Then try to get to https gmail again. What does that show? Is the tcp handshake completing? Are you getting packets back, but your browser just isn't rendering a page? I'm not sure this capture will lend itself to a solution, but it could be a starting point.

---

edit: It sounds like you're on a Windows workstation. Packet captures can be run there using wireshark instead.

Last edited by anomie; 04-03-2009 at 02:34 PM.
 
Old 04-03-2009, 05:22 PM   #7
pliqui
Member
 
Registered: Feb 2007
Location: Caracas, Venezuela
Distribution: Debian x64
Posts: 156

Original Poster
Rep: Reputation: 17
Well, i'm having seen this either and yes, i'm in a windows machine but also can use the linux box and is the same problem, in fact i have wireshark installed due a problem not long ago with a xml, but i'm not good at this area of networking

Going to post since i hit gmail until stop loading. This is what tcpdump throws:

Code:
intranet:~# tcpdump port 443
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
12:57:25.685524 IP XXX.XXX.XXX.XXX.57830 > qw-in-f103.google.com.https: S 468228277:468228277(0) win 5840 <mss 1460,sackOK,timestamp 107263 0,nop,wscale 6>
12:57:28.685245 IP XXX.XXX.XXX.XXX.57830 > qw-in-f103.google.com.https: S 468228277:468228277(0) win 5840 <mss 1460,sackOK,timestamp 108013 0,nop,wscale 6>
12:57:33.008361 IP XXX.XXX.XXX.XXX.55419 > qw-in-f104.google.com.https: S 578637333:578637333(0) win 5840 <mss 1460,sackOK,timestamp 109093 0,nop,wscale 6>
12:57:36.005247 IP XXX.XXX.XXX.XXX.55419 > qw-in-f104.google.com.https: S 578637333:578637333(0) win 5840 <mss 1460,sackOK,timestamp 109843 0,nop,wscale 6>
12:57:41.004180 IP XXX.XXX.XXX.XXX.33646 > qw-in-f147.google.com.https: S 705662653:705662653(0) win 5840 <mss 1460,sackOK,timestamp 111092 0,nop,wscale 6>
12:57:44.001245 IP XXX.XXX.XXX.XXX.33646 > qw-in-f147.google.com.https: S 705662653:705662653(0) win 5840 <mss 1460,sackOK,timestamp 111842 0,nop,wscale 6>
12:57:49.004246 IP XXX.XXX.XXX.XXX.36533 > qw-in-f99.google.com.https: S 818719574:818719574(0) win 5840 <mss 1460,sackOK,timestamp 113092 0,nop,wscale 6>
12:57:52.001246 IP XXX.XXX.XXX.XXX.36533 > qw-in-f99.google.com.https: S 818719574:818719574(0) win 5840 <mss 1460,sackOK,timestamp 113842 0,nop,wscale 6>
12:57:57.004322 IP XXX.XXX.XXX.XXX.37123 > qw-in-f103.google.com.https: S 958232474:958232474(0) win 5840 <mss 1460,sackOK,timestamp 115092 0,nop,wscale 6>
12:58:00.001246 IP XXX.XXX.XXX.XXX.37123 > qw-in-f103.google.com.https: S 958232474:958232474(0) win 5840 <mss 1460,sackOK,timestamp 115842 0,nop,wscale 6>
12:58:05.004402 IP XXX.XXX.XXX.XXX.32971 > qw-in-f104.google.com.https: S 1081559557:1081559557(0) win 5840 <mss 1460,sackOK,timestamp 117092 0,nop,wscale 6>
12:58:08.001254 IP XXX.XXX.XXX.XXX.32971 > qw-in-f104.google.com.https: S 1081559557:1081559557(0) win 5840 <mss 1460,sackOK,timestamp 117842 0,nop,wscale 6>
13:00:49.512591 IP XXX.XXX.XXX.XXX.https > XXX.XXX.XXX.XXX.3310: . 2103551899:2103553359(1460) ack 1650894787 win 65535
13:00:49.513821 IP XXX.XXX.XXX.XXX.https > XXX.XXX.XXX.XXX.3310: . 1460:2920(1460) ack 1 win 65535
13:00:49.515402 IP XXX.XXX.XXX.XXX.https > XXX.XXX.XXX.XXX.3310: . 2920:4380(1460) ack 1 win 65535
13:01:36.212568 IP XXX.XXX.XXX.XXX.4331 > XXX.XXX.XXX.XXX.https: P 1400359417:1400359440(23) ack 4025142883 win 65535
13:01:36.212629 IP XXX.XXX.XXX.XXX.4331 > XXX.XXX.XXX.XXX.https: F 23:23(0) ack 1 win 65535
13:01:52.547284 IP XXX.XXX.XXX.XXX.https > XXX.XXX.XXX.XXX.1779: F 2375261454:2375261454(0) ack 104142930 win 64462
Anything weird? and really thanks for your time invested here, really appreciate it
 
Old 04-03-2009, 05:57 PM   #8
anomie
Senior Member
 
Registered: Nov 2004
Location: Texas
Distribution: RHEL, Scientific Linux, Debian, Fedora
Posts: 3,935
Blog Entries: 5

Rep: Reputation: Disabled
Quote:
Originally Posted by pliqui
Anything weird?
Yes, something is weird.

You had to send twelve SYN packets to six different gmail servers (two to each server), and I did not see any SYN-ACK come back.

---

The other thing that is weird is I told you the wrong tcpdump filter, but you still captured traffic. You ran that tcpdump session on a client workstation, right?

This likely means that you are not using the squid proxy for https traffic. In other words, squid's default tcp port is 3128 -- I should have told you to sniff there. Since we saw outbound traffic to tcp port 443, we know your browser is doing the wrong thing.

So, check your browser settings. You'll need to point both http and https (and maybe ftp, etc.) traffic to your squid proxy.

Last edited by anomie; 04-03-2009 at 06:02 PM. Reason: typo
 
Old 04-06-2009, 09:10 AM   #9
pliqui
Member
 
Registered: Feb 2007
Location: Caracas, Venezuela
Distribution: Debian x64
Posts: 156

Original Poster
Rep: Reputation: 17
Good Morning Anomie,

Well, i logged into the squid box with putty and ran the tcpdump and all types of connection for proxy was checked in the browser, so this is a real mystery for me.

I will use the windows machine with firefox to connect to the gmail and i will do a tcpdump on port 3128, same way of the last time, i hit gmail until stop loading.

Code:
intranet:~# tcpdump port 3128
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
04:56:36.836645 IP XXX.XXX.XXX.XXX.nessus > XXX.XXX.XXX.XXX.3
04:56:36.836666 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.nes
04:56:36.836991 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.nes
04:56:36.868776 IP XXX.XXX.XXX.XXX.1240 > XXX.XXX.XXX.XXX.312
04:56:36.868790 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.124
04:56:36.957284 IP XXX.XXX.XXX.XXX.nessus > XXX.XXX.XXX.XXX.3
04:56:37.142488 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.124
04:56:37.143915 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.124
04:56:37.144794 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.124
04:56:37.144803 IP XXX.XXX.XXX.XXX.1240 > XXX.XXX.XXX.XXX.312
04:56:37.145894 IP XXX.XXX.XXX.XXX.1240 > XXX.XXX.XXX.XXX.312
04:56:37.145958 IP XXX.XXX.XXX.XXX.1240 > XXX.XXX.XXX.XXX.312
04:56:37.145976 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.124
04:56:37.148739 IP XXX.XXX.XXX.XXX.1245 > XXX.XXX.XXX.XXX.312>
04:56:37.148753 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.124op,nop,sackOK>
04:56:37.149372 IP XXX.XXX.XXX.XXX.1245 > XXX.XXX.XXX.XXX.312
04:56:37.150086 IP XXX.XXX.XXX.XXX.1245 > XXX.XXX.XXX.XXX.312
04:56:37.150098 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.124
04:56:45.001558 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.124
04:56:45.002157 IP XXX.XXX.XXX.XXX.1245 > XXX.XXX.XXX.XXX.312
04:56:45.002521 IP XXX.XXX.XXX.XXX.1245 > XXX.XXX.XXX.XXX.312
04:56:45.002536 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.124
04:56:45.003989 IP XXX.XXX.XXX.XXX.1246 > XXX.XXX.XXX.XXX.312>
04:56:45.004003 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.124op,nop,sackOK>
04:56:45.004847 IP XXX.XXX.XXX.XXX.1246 > XXX.XXX.XXX.XXX.312
04:56:45.005560 IP XXX.XXX.XXX.XXX.1246 > XXX.XXX.XXX.XXX.312
04:56:45.005572 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.124
04:56:53.001527 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.124
04:56:53.002102 IP XXX.XXX.XXX.XXX.1246 > XXX.XXX.XXX.XXX.312
04:56:53.002596 IP XXX.XXX.XXX.XXX.1246 > XXX.XXX.XXX.XXX.312
04:56:53.002610 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.124
04:56:53.003567 IP XXX.XXX.XXX.XXX.1247 > XXX.XXX.XXX.XXX.312OK>
04:56:53.003579 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.124nop,nop,sackOK>
04:56:53.004416 IP XXX.XXX.XXX.XXX.1247 > XXX.XXX.XXX.XXX.312
04:56:53.005004 IP XXX.XXX.XXX.XXX.1247 > XXX.XXX.XXX.XXX.312
04:56:53.005015 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.124
04:57:01.001531 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.124
04:57:01.002104 IP XXX.XXX.XXX.XXX.1247 > XXX.XXX.XXX.XXX.312
04:57:01.002640 IP XXX.XXX.XXX.XXX.1247 > XXX.XXX.XXX.XXX.312
04:57:01.002661 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.124
04:57:01.003964 IP XXX.XXX.XXX.XXX.1248 > XXX.XXX.XXX.XXX.312OK>
04:57:01.003976 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.124nop,nop,sackOK>
04:57:01.004833 IP XXX.XXX.XXX.XXX.1248 > XXX.XXX.XXX.XXX.312
04:57:01.005511 IP XXX.XXX.XXX.XXX.1248 > XXX.XXX.XXX.XXX.312
04:57:01.005522 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.124
04:57:09.001534 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.1248: F 1:1(0) ack 196 win 6432
04:57:09.002108 IP XXX.XXX.XXX.XXX.1248 > XXX.XXX.XXX.XXX.3128: . ack 2 win 65535
04:57:09.002658 IP XXX.XXX.XXX.XXX.1248 > XXX.XXX.XXX.XXX.3128: F 196:196(0) ack 2 win 65535
04:57:09.002669 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.1248: . ack 197 win 6432
04:57:09.005772 IP XXX.XXX.XXX.XXX.1249 > XXX.XXX.XXX.XXX.3128: S 1593116986:1593116986(0) win 65535 <mss 1260,nop,nop,sackOK>
04:57:09.005785 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.1249: S 1017061521:1017061521(0) ack 1593116987 win 5840 <mss 1460,nop,nop,sackOK>
04:57:09.006557 IP XXX.XXX.XXX.XXX.1249 > XXX.XXX.XXX.XXX.3128: . ack 1 win 65535
04:57:09.006916 IP XXX.XXX.XXX.XXX.1249 > XXX.XXX.XXX.XXX.3128: P 1:196(195) ack 1 win 65535
04:57:09.006929 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.1249: . ack 196 win 6432
04:57:17.001559 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.1249: F 1:1(0) ack 196 win 6432
04:57:17.002156 IP XXX.XXX.XXX.XXX.1249 > XXX.XXX.XXX.XXX.3128: . ack 2 win 65535
04:57:17.002534 IP XXX.XXX.XXX.XXX.1249 > XXX.XXX.XXX.XXX.3128: F 196:196(0) ack 2 win 65535
04:57:17.002547 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.1249: . ack 197 win 6432
04:57:17.003394 IP XXX.XXX.XXX.XXX.1250 > XXX.XXX.XXX.XXX.3128: S 219512063:219512063(0) win 65535 <mss 1260,nop,nop,sackOK>
04:57:17.003405 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.1250: S 1139199011:1139199011(0) ack 219512064 win 5840 <mss 1460,nop,nop,sackOK>
04:57:17.004259 IP XXX.XXX.XXX.XXX.1250 > XXX.XXX.XXX.XXX.3128: . ack 1 win 65535
04:57:17.004486 IP XXX.XXX.XXX.XXX.1250 > XXX.XXX.XXX.XXX.3128: P 1:196(195) ack 1 win 65535
04:57:17.004498 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.1250: . ack 196 win 6432
04:57:25.005526 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.125
04:57:25.006090 IP XXX.XXX.XXX.XXX.1250 > XXX.XXX.XXX.XXX.312
04:57:25.006575 IP XXX.XXX.XXX.XXX.1250 > XXX.XXX.XXX.XXX.312
04:57:25.006589 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.125
04:57:25.007571 IP XXX.XXX.XXX.XXX.1253 > XXX.XXX.XXX.XXX.312>
04:57:25.007586 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.125,nop,nop,sackOK>
04:57:25.008457 IP XXX.XXX.XXX.XXX.1253 > XXX.XXX.XXX.XXX.312
04:57:25.008954 IP XXX.XXX.XXX.XXX.1253 > XXX.XXX.XXX.XXX.312
04:57:25.008969 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.125
04:57:33.005540 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.125
04:57:33.006121 IP XXX.XXX.XXX.XXX.1253 > XXX.XXX.XXX.XXX.312
04:57:33.006483 IP XXX.XXX.XXX.XXX.1253 > XXX.XXX.XXX.XXX.312
04:57:33.006497 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.125
04:57:33.007104 IP XXX.XXX.XXX.XXX.1254 > XXX.XXX.XXX.XXX.312OK>
04:57:33.007117 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.1250,nop,nop,sackOK>
04:57:33.008059 IP XXX.XXX.XXX.XXX.1254 > XXX.XXX.XXX.XXX.312
04:57:33.008352 IP XXX.XXX.XXX.XXX.1254 > XXX.XXX.XXX.XXX.312
04:57:33.008364 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.125
04:57:41.005534 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.125
04:57:41.006118 IP XXX.XXX.XXX.XXX.1254 > XXX.XXX.XXX.XXX.312
04:57:41.006479 IP XXX.XXX.XXX.XXX.1254 > XXX.XXX.XXX.XXX.312
04:57:41.006491 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.125
04:57:41.007126 IP XXX.XXX.XXX.XXX.1255 > XXX.XXX.XXX.XXX.312OK>
04:57:41.007141 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.1250,nop,nop,sackOK>
04:57:41.007561 IP XXX.XXX.XXX.XXX.1255 > XXX.XXX.XXX.XXX.312
04:57:41.008641 IP XXX.XXX.XXX.XXX.1255 > XXX.XXX.XXX.XXX.312
04:57:41.008653 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.125
04:57:49.005541 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.125
04:57:49.006104 IP XXX.XXX.XXX.XXX.1255 > XXX.XXX.XXX.XXX.312
04:57:49.006598 IP XXX.XXX.XXX.XXX.1255 > XXX.XXX.XXX.XXX.312
04:57:49.006611 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.125
04:57:49.007705 IP XXX.XXX.XXX.XXX.1256 > XXX.XXX.XXX.XXX.312OK>
04:57:49.007719 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.1250,nop,nop,sackOK>
04:57:49.008380 IP XXX.XXX.XXX.XXX.1256 > XXX.XXX.XXX.XXX.312
04:57:49.008606 IP XXX.XXX.XXX.XXX.1256 > XXX.XXX.XXX.XXX.312
04:57:49.008618 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.125
04:57:57.005558 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.125
04:57:57.006138 IP XXX.XXX.XXX.XXX.1256 > XXX.XXX.XXX.XXX.312
04:57:57.009329 IP XXX.XXX.XXX.XXX.1256 > XXX.XXX.XXX.XXX.312
04:57:57.009343 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.125
04:58:27.760643 IP XXX.XXX.XXX.XXX.nessus > XXX.XXX.XXX.XXX.3
04:58:27.761032 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.nes
04:58:27.764784 IP XXX.XXX.XXX.XXX.nessus > XXX.XXX.XXX.XXX.3
04:58:27.801240 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.nes
04:58:28.923786 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.nes
04:58:29.100498 IP XXX.XXX.XXX.XXX.nessus > XXX.XXX.XXX.XXX.3
04:58:29.307862 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.nes
04:58:29.308314 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.nes
04:58:29.308837 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.nes
04:58:29.311975 IP XXX.XXX.XXX.XXX.nessus > XXX.XXX.XXX.XXX.3
04:58:29.502804 IP XXX.XXX.XXX.XXX.nessus > XXX.XXX.XXX.XXX.3
04:58:30.401748 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.nes
04:58:30.404108 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.nes
04:58:30.404593 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.nes
04:58:30.410872 IP XXX.XXX.XXX.XXX.nessus > XXX.XXX.XXX.XXX.3
04:58:30.410887 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.nes
04:58:30.410893 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.nes
04:58:30.416303 IP XXX.XXX.XXX.XXX.nessus > XXX.XXX.XXX.XXX.3
04:58:30.416314 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.nes
04:58:30.416319 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.nes
04:58:30.424217 IP XXX.XXX.XXX.XXX.nessus > XXX.XXX.XXX.XXX.3
04:58:30.429506 IP XXX.XXX.XXX.XXX.nessus > XXX.XXX.XXX.XXX.3
04:58:30.607228 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.nes
04:58:30.607711 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.nes
04:58:30.609775 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.nes
04:58:30.611214 IP XXX.XXX.XXX.XXX.nessus > XXX.XXX.XXX.XXX.3
04:58:30.611333 IP XXX.XXX.XXX.XXX.3128 > XXX.XXX.XXX.XXX.nes
04:58:30.611842 IP XXX.XXX.XXX.XXX.nessus > XXX.XXX.XXX.XXX.3
04:58:30.810246 IP XXX.XXX.XXX.XXX.nessus > XXX.XXX.XXX.XXX.3
Now i regret not completing my CCNA back in 2002 lol, well, venezuela went to a general strike and need to save money, just did the 1st module, passed with 82% tho

Any other info you need just tell me and thanks again
 
Old 04-06-2009, 12:09 PM   #10
anomie
Senior Member
 
Registered: Nov 2004
Location: Texas
Distribution: RHEL, Scientific Linux, Debian, Fedora
Posts: 3,935
Blog Entries: 5

Rep: Reputation: Disabled
pliqui: I do not see anything in that tcpdump output that indicates you are making https connections to gmail. Can you double check that your web browser is using the proxy for both http and https? Check here for an example of what firefox should look like: http://img168.imageshack.us/my.php?image=proxyshot.png

Also, I don't want to invade your privacy, but for your tcpdump output it would be better to not obfuscate the IP addresses. (It makes it too difficult to understand the tcp conversation.)
 
Old 04-06-2009, 09:45 PM   #11
anomie
Senior Member
 
Registered: Nov 2004
Location: Texas
Distribution: RHEL, Scientific Linux, Debian, Fedora
Posts: 3,935
Blog Entries: 5

Rep: Reputation: Disabled
One more thing we could try to support the point that the problem is likely on the end-user/browser side and not with squid itself -- run this on the squid server box:
Code:
$ /usr/sbin/squidclient https://mail.google.com/mail
What does that output? *

* If it dumps some html-formatted data telling you that the document has moved, then try squidclient with the moved URL (it may be rather long). Does that URL dump another page into your terminal?
 
Old 04-07-2009, 10:58 AM   #12
pliqui
Member
 
Registered: Feb 2007
Location: Caracas, Venezuela
Distribution: Debian x64
Posts: 156

Original Poster
Rep: Reputation: 17
Sorry about the ip obfuscation, when i captured the port 3128 was only the packets between the squid box and the windows pc. And i'm using the squid in all protocols i cannot upload the pic from work, will do tonight at home.

The squid client command

Code:
intranet:~# squidclient https://mail.google.com/mail
HTTP/1.0 501 Not Implemented
Server: squid/3.0.STABLE8
Mime-Version: 1.0
Date: Tue, 07 Apr 2009 11:10:40 GMT
Content-Type: text/html
Content-Length: 1379
Expires: Tue, 07 Apr 2009 11:10:40 GMT
X-Squid-Error: ERR_UNSUP_REQ 0
X-Cache: MISS from localhost
X-Cache-Lookup: NONE from localhost:3128
Via: 1.0 localhost (squid/3.0.STABLE8)
Proxy-Connection: close

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<TITLE>ERROR: The requested URL could not be retrieved</TITLE>
<STYLE type="text/css"><!--BODY{background-color:#ffffff;font-family:verdana,sans-serif}PRE{font-family:sans-serif}--></STYLE>
</HEAD><BODY>
<H1>ERROR</H1>
<H2>The requested URL could not be retrieved</H2>
<HR noshade size="1px">
<P>
While trying to retrieve the URL:
<A HREF="https://mail.google.com/mail">https://mail.google.com/mail</A>
<P>
The following error was encountered:
<UL>
<LI>
<STRONG>
Unsupported Request Method and Protocol
</STRONG>
</UL>

<P>
Squid does not support all request methods for all access protocols.
For example, you can not POST a Gopher request.
<P>Your cache administrator is <A HREF="mailto:webmaster?subject=CacheErrorInfo%20-%20ERR_UNSUP_REQ&amp;body=CacheHost%3A%20localhost%0D%0AErrPage%3A%20ERR_UNSUP_REQ%0D%0AErr%3A%20%5Bnone%5D%0D%0ATimeStamp%3A%20Tue,%2007%20Apr%202009%2011%3A10%3A40%20GMT%0D%0A%0D%0AClientIP%3A%20127.0.0.1%0D%0AServerIP%3A%20%0D%0A%0D%0AHTTP%20Request%3A%0D%0AGET%20%2Fmail%20HTTP%2F1.0%0AAccept%3A%20*%2F*%0D%0A%0D%0A%0D%0A">webmaster</A>.

<br>
<hr>
<div id="footer">
Generated Tue, 07 Apr 2009 11:10:40 GMT by localhost (squid/3.0.STABLE8)
</div>
</body></html>
Was a single page html, and with some warnings Unsupported Request Method and Protocol 1st time i'm seeing that.
 
Old 04-07-2009, 12:22 PM   #13
anomie
Senior Member
 
Registered: Nov 2004
Location: Texas
Distribution: RHEL, Scientific Linux, Debian, Fedora
Posts: 3,935
Blog Entries: 5

Rep: Reputation: Disabled
Aha. Let's see your squid.conf (edit: I see you posted it already in the first post; reading it now.) -- maybe you're denying CONNECT method (although I would think that error message would be a bit different).

Code:
# egrep -v '(^$|^#)' squid.conf
Also see if this thread applies to your setup.

Last edited by anomie; 04-07-2009 at 12:26 PM.
 
Old 04-07-2009, 12:33 PM   #14
anomie
Senior Member
 
Registered: Nov 2004
Location: Texas
Distribution: RHEL, Scientific Linux, Debian, Fedora
Posts: 3,935
Blog Entries: 5

Rep: Reputation: Disabled
Well, I am out of ideas for the moment (unless you're doing some redirection as described in the thread I linked to above).

You installed squid from official Debian repositories? If "yes", then maybe see if an upgrade is available. If "no", then I would save your config and install from an official source.
 
Old 04-08-2009, 10:36 PM   #15
pliqui
Member
 
Registered: Feb 2007
Location: Caracas, Venezuela
Distribution: Debian x64
Posts: 156

Original Poster
Rep: Reputation: 17
Yes, i installed squid from debian repositories, today installed the unstable version and same problem, was searching the error that the squid client told us and seems to be the squid.

Will search more and try to think a way to fix it.

I really appreciate your time invested here, i learned a few tricks.

Thanks !
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
squid3 use only RAM xxxx Linux - Server 0 09-16-2008 03:44 AM
HTTPS Proxy to provide secure access to LAN pages? jantman Linux - Security 2 10-22-2007 09:21 PM
Lighttpd HTTPS Web Pages Speed Synesthesia Linux - Software 0 03-07-2007 09:16 PM
Odd Apache Error [Only servers https pages with :80] dfiore Linux - Server 8 11-28-2006 11:34 PM
A unknown error accesing https pages... Would be the squid.conf guilty?? mnfjzog Linux - General 1 11-14-2003 04:01 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 04:45 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration