<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
Hello,
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">Eliezer’s recommended fix did not work.</div>
<div class=""><br class="">
</div>
<div class="">The user was on YouTube watching UFC all day today.</div>
<div class=""><br class="">
</div>
<div class="">Here’s a copy of the log at the time.</div>
<div class="">
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1482436450.285 353
</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">10.0.0.105</span><span style="font-variant-ligatures: no-common-ligatures" class=""> TAG_NONE/200 0 CONNECT 167.114.159.186:443 - ORIGINAL_DST/167.114.159.186 -</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1482436450.303 0
</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">10.0.0.105</span><span style="font-variant-ligatures: no-common-ligatures" class=""> TAG_NONE/503 4462 CONNECT
<a href="http://s.youtube.com" class="">s.youtube.com</a>:443 - HIER_NONE/- text/html</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1482436450.318 4756
</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">10.0.0.105</span><span style="font-variant-ligatures: no-common-ligatures" class=""> TAG_NONE/200 0 CONNECT 139.59.225.84:443 - ORIGINAL_DST/139.59.225.84 -</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1482436450.340 0
</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">10.0.0.105</span><span style="font-variant-ligatures: no-common-ligatures" class=""> TAG_NONE/503 4456 CONNECT
<a href="http://s.youtube.com" class="">s.youtube.com</a>:443 - HIER_NONE/- text/html</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1482436450.567 839
</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">10.0.0.105</span><span style="font-variant-ligatures: no-common-ligatures" class=""> TAG_NONE/200 0 CONNECT 188.166.70.138:443 - ORIGINAL_DST/188.166.70.138 -</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1482436450.585 0
</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">10.0.0.105</span><span style="font-variant-ligatures: no-common-ligatures" class=""> TAG_NONE/503 4459 CONNECT
<a href="http://s.youtube.com" class="">s.youtube.com</a>:443 - HIER_NONE/- text/html</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1482436450.650 373
</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">10.0.0.105</span><span style="font-variant-ligatures: no-common-ligatures" class=""> TAG_NONE/200 0 CONNECT 85.203.7.35:443 - ORIGINAL_DST/85.203.7.35 -</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1482436450.669 0
</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">10.0.0.105</span><span style="font-variant-ligatures: no-common-ligatures" class=""> TAG_NONE/503 4450 CONNECT
<a href="http://s.youtube.com" class="">s.youtube.com</a>:443 - HIER_NONE/- text/html</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1482436450.682 1969
</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">10.0.0.105</span><span style="font-variant-ligatures: no-common-ligatures" class=""> TAG_NONE/200 0 CONNECT 139.59.225.84:443 - ORIGINAL_DST/139.59.225.84 -</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1482436450.706 386
</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">10.0.0.105</span><span style="font-variant-ligatures: no-common-ligatures" class=""> TAG_NONE/200 0 CONNECT 188.166.73.9:443 - ORIGINAL_DST/188.166.73.9 -</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1482436450.740 6540
</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">10.0.0.105</span><span style="font-variant-ligatures: no-common-ligatures" class=""> TAG_NONE/200 0 CONNECT 85.203.18.254:443 - ORIGINAL_DST/85.203.18.254 -</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1482436450.784 0
</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">10.0.0.105</span><span style="font-variant-ligatures: no-common-ligatures" class=""> TAG_NONE/503 4456 CONNECT
<a href="http://s.youtube.com" class="">s.youtube.com</a>:443 - HIER_NONE/- text/html</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1482436450.784 0
</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">10.0.0.105</span><span style="font-variant-ligatures: no-common-ligatures" class=""> TAG_NONE/503 4453 CONNECT
<a href="http://s.youtube.com" class="">s.youtube.com</a>:443 - HIER_NONE/- text/html</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1482436450.784 0
</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">10.0.0.105</span><span style="font-variant-ligatures: no-common-ligatures" class=""> TAG_NONE/503 4456 CONNECT
<a href="http://s.youtube.com" class="">s.youtube.com</a>:443 - HIER_NONE/- text/html</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1482436450.909 469
</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">10.0.0.105</span><span style="font-variant-ligatures: no-common-ligatures" class=""> TAG_NONE/200 0 CONNECT 138.68.93.229:443 - ORIGINAL_DST/138.68.93.229 -</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1482436450.927 1882
</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">10.0.0.105</span><span style="font-variant-ligatures: no-common-ligatures" class=""> TAG_NONE/200 0 CONNECT 208.123.223.254:443 - ORIGINAL_DST/208.123.223.254 -</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1482436450.940 0
</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">10.0.0.105</span><span style="font-variant-ligatures: no-common-ligatures" class=""> TAG_NONE/503 4456 CONNECT
<a href="http://s.youtube.com" class="">s.youtube.com</a>:443 - HIER_NONE/- text/html</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1482436450.955 0
</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">10.0.0.105</span><span style="font-variant-ligatures: no-common-ligatures" class=""> TAG_NONE/503 4462 CONNECT
<a href="http://s.youtube.com" class="">s.youtube.com</a>:443 - HIER_NONE/- text/html</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1482436451.063 197
</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">10.0.0.105</span><span style="font-variant-ligatures: no-common-ligatures" class=""> TAG_NONE/200 0 CONNECT 208.123.223.254:443 - ORIGINAL_DST/208.123.223.254 -</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1482436451.080 0
</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">10.0.0.105</span><span style="font-variant-ligatures: no-common-ligatures" class=""> TAG_NONE/503 4462 CONNECT
<a href="http://s.youtube.com" class="">s.youtube.com</a>:443 - HIER_NONE/- text/html</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1482436451.217 434
</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">10.0.0.105</span><span style="font-variant-ligatures: no-common-ligatures" class=""> TAG_NONE/200 0 CONNECT 138.68.97.9:443 - ORIGINAL_DST/138.68.97.9 -</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1482436451.236 0
</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">10.0.0.105</span><span style="font-variant-ligatures: no-common-ligatures" class=""> TAG_NONE/503 4450 CONNECT
<a href="http://s.youtube.com" class="">s.youtube.com</a>:443 - HIER_NONE/- text/html</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1482436451.322 271
</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">10.0.0.105</span><span style="font-variant-ligatures: no-common-ligatures" class=""> TAG_NONE/200 0 CONNECT 65.52.108.76:443 - ORIGINAL_DST/65.52.108.76 -</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1482436451.345 479
</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">10.0.0.105</span><span style="font-variant-ligatures: no-common-ligatures" class=""> TAG_NONE/200 0 CONNECT 138.68.93.229:443 - ORIGINAL_DST/138.68.93.229 -</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1482436451.361 0
</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">10.0.0.105</span><span style="font-variant-ligatures: no-common-ligatures" class=""> TAG_NONE/503 4456 CONNECT
<a href="http://s.youtube.com" class="">s.youtube.com</a>:443 - HIER_NONE/- text/html</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1482436451.498 4240
</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">10.0.0.105</span><span style="font-variant-ligatures: no-common-ligatures" class=""> TAG_NONE/200 0 CONNECT 139.59.225.84:443 - ORIGINAL_DST/139.59.225.84 -</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1482436451.530 0
</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">10.0.0.105</span><span style="font-variant-ligatures: no-common-ligatures" class=""> TAG_NONE/503 4456 CONNECT
<a href="http://s.youtube.com" class="">s.youtube.com</a>:443 - HIER_NONE/- text/html</span></div>
<div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(41, 249, 20); background-color: rgb(0, 0, 0);" class="">
<span style="font-variant-ligatures: no-common-ligatures" class="">1482436451.909 817
</span><span style="font-variant-ligatures: no-common-ligatures; color: #c33720" class="">10.0.0.105</span><span style="font-variant-ligatures: no-common-ligatures" class=""> TAG_NONE/200 0 CONNECT 188.166.70.138:443 - ORIGINAL_DST/188.166.70.138 -</span></div>
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">I know 503 is an error, but the user was using youtube without any hassles.</div>
<div class="">Those IPs are for Digital Ocean and Alentus Corporation.</div>
<div class=""><br class="">
</div>
<div class="">Squid is being “fooled” somehow. </div>
<div class=""> I did notice the 503, which made it more confusing to me.</div>
<blockquote type="cite" class="">The reason I investigated the issue was because I saw youtube working on the client’s PC with a blue shield-like icon along with some words on top of the youtube page (was not close enough to see the exact logo/words). The video
was working fine, but that blue shield extension seems to be the reason behind “fooling” squid.</blockquote>
<div class=""><br class="">
</div>
<div class="">Both the chrome extension and the Desktop client are installed on the machine.</div>
<div class=""><br class="">
</div>
<div class="">I tried replicating that, but I couldn’t even connect the client.</div>
<div class=""><br class="">
</div>
<div class="">What should I be looking for in cache.log?</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">Thanks again!</div>
<div class=""><br class="">
</div>
<div class="">Sam</div>
<div class=""><br class="">
<div>
<blockquote type="cite" class="">
<div class="">On Dec 21, 2016, at 6:59 PM, Sameh Onaissi <<a href="mailto:sameh.onaissi@solcv.com" class="">sameh.onaissi@solcv.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div class=""><br class="">
<br class="">
<br class="">
<br class="">
<blockquote type="cite" class="">On Dec 21, 2016, at 6:51 PM, Alex Rousskov <<a href="mailto:rousskov@measurement-factory.com" class="">rousskov@measurement-factory.com</a>> wrote:<br class="">
<br class="">
On 12/21/2016 10:14 AM, Sameh Onaissi wrote:<br class="">
<br class="">
<blockquote type="cite" class="">One user is somehow, able to access you tube through squid!<br class="">
</blockquote>
<br class="">
<blockquote type="cite" class="">1482339083.228 0 10.0.0.162 TAG_NONE/503 4459 CONNECT
<a href="http://s.youtube.com" class="">s.youtube.com</a>:443 - HIER_NONE/- text/html<br class="">
</blockquote>
<br class="">
What makes you think this user was able to access youtube? AFAICT, Squid<br class="">
responded with an error (TAG_NONE/503) and did not contact the origin<br class="">
server (HIER_NONE/-).<br class="">
</blockquote>
<br class="">
I did notice the 503, which made it more confusing to me.<br class="">
The reason I investigated the issue was because I saw youtube working on the client’s PC with a blue shield-like icon along with some words on top of the youtube page (was not close enough to see the exact logo/words). The video was working fine, but that blue
shield extension seems to be the reason behind “fooling” squid.<br class="">
<br class="">
In any case, I applied the ACL’s to the squid.conf as Eliezer recommended, now I’ll wait till the user comes back in tomorrow to see if it worked.<br class="">
<br class="">
<blockquote type="cite" class=""><br class="">
I understand that you want Squid to redirect users instead of responding<br class="">
with an error. This 503 response could be due to Squid being unable to<br class="">
bump the user connection for some reason. Successful bumping is required<br class="">
to redirect users.<br class="">
<br class="">
You may see more details inside that error response itself. Others on<br class="">
the list may be able to help you to get to that response in Squid logs<br class="">
or packet captures.<br class="">
<br class="">
<br class="">
HTH,<br class="">
<br class="">
Alex.<br class="">
<br class="">
</blockquote>
<br class="">
</div>
</div>
</blockquote>
</div>
<br class="">
</div>
</body>
</html>