<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>I got today these hits repeating all day long:</p>
<p>1542992067.660 1 10.15.3.137 TCP_HIT/206 427 GET
<a class="moz-txt-link-freetext" href="http://archive.canonical.com/pool/partner/a/adobe-flashplugin/adobe-flashplugin_20181120.1.orig.tar.gz">http://archive.canonical.com/pool/partner/a/adobe-flashplugin/adobe-flashplugin_20181120.1.orig.tar.gz</a>
- HIER_NONE/- application/x-gzip<br>
1542992067.717 1 10.15.3.137 TCP_HIT/206 427 GET
<a class="moz-txt-link-freetext" href="http://archive.canonical.com/pool/partner/a/adobe-flashplugin/adobe-flashplugin_20181120.1.orig.tar.gz">http://archive.canonical.com/pool/partner/a/adobe-flashplugin/adobe-flashplugin_20181120.1.orig.tar.gz</a>
- HIER_NONE/- application/x-gzip<br>
1542992067.779 1 10.15.3.137 TCP_HIT/206 427 GET
<a class="moz-txt-link-freetext" href="http://archive.canonical.com/pool/partner/a/adobe-flashplugin/adobe-flashplugin_20181120.1.orig.tar.gz">http://archive.canonical.com/pool/partner/a/adobe-flashplugin/adobe-flashplugin_20181120.1.orig.tar.gz</a>
- HIER_NONE/- application/x-gzip</p>
<p>a tcpdump shows me a partial get from client:</p>
<blockquote>
<p>GET
<a class="moz-txt-link-freetext" href="http://archive.canonical.com/pool/partner/a/adobe-flashplugin/adobe-flashplugin_20181120.1.orig.tar.gz">http://archive.canonical.com/pool/partner/a/adobe-flashplugin/adobe-flashplugin_20181120.1.orig.tar.gz</a>
HTTP/1.1<br>
Host: archive.canonical.com<br>
Range: bytes=3790651-<br>
If-Range: Tue, 20 Nov 2018 13:54:54 GMT<br>
User-Agent: Debian APT-HTTP/1.3 (1.6.6)</p>
</blockquote>
<p><br>
</p>
<p>and proxy anwers like this:</p>
<blockquote>
<p>HTTP/1.1 206 Partial Content<br>
Date: Thu, 22 Nov 2018 10:40:20 GMT<br>
Server: Apache/2.4.18 (Ubuntu)<br>
Last-Modified: Tue, 20 Nov 2018 13:54:54 GMT<br>
ETag: "1d1c25d-57b18fa72c3e2"<br>
Accept-Ranges: bytes<br>
Content-Type: application/x-gzip<br>
Age: 108770<br>
Warning: 113 proxy (squid) This cache hit is still fresh and
more than 1 day old<br>
Connection: keep-alive<br>
Content-Range: bytes 3790651-30523996/30523997<br>
Content-Length: 26733346</p>
</blockquote>
<p>But there isn't much being transfered after it. And it should
transfer 26,733,346 bytes, right? But look at the tcp packet
capture <b>right after the above</b> one:</p>
<p>13:53:10.070860 IP 10.1.10.9.3080 > 10.15.3.137.43098: Flags [<font
size="+2"><b>F.</b></font>], seq 428, ack 254, win 33, options
[nop,nop,TS val 70122782 ecr 1622121716], length 0<br>
<a class="moz-txt-link-abbreviated" href="mailto:E..4c.@.@..E">E..4c.@.@..E</a><br>
.<br>
<br>
......Z.-.qpl"Z...!!......<br>
.-..`...<br>
13:53:10.085478 IP 10.15.3.137.43098 > 10.1.10.9.3080: Flags
[.], ack 428, win 237, options [nop,nop,TS val 1622121737 ecr
70122782], length 0<br>
E..4..@.?...<br>
...<br>
.<br>
.Z..pl"Z.-.q.....a.....<br>
`.. .-..<br>
13:53:10.103003 IP 10.15.3.137.43098 > 10.1.10.9.3080: Flags
[F.], seq 254, ack 429, win 237, options [nop,nop,TS val
1622121737 ecr 70122782], length 0<br>
E..4..@.?...<br>
...<br>
.<br>
.Z..pl"Z.-.r....._.....<br>
`.. .-..<br>
13:53:10.103024 IP 10.1.10.9.3080 > 10.15.3.137.43098: Flags
[.], ack 255, win 33, options [nop,nop,TS val 70122790 ecr
1622121737], length 0</p>
<p>It seems the proxy just closes the connection, then the client
connects again and tries to get the same part everytime... There's
nothing unusual on cache*.log</p>
<p>I think this file type is being "treated" by this
pattern_refresh, I don't know if it would mess with anything, I
think probably not:</p>
<p>refresh_pattern -i
\.(udeb|exe|ms[iup]|xz|xml|bz2|gz|deb|rpm|bin|zip|ax|rpm|app|jar|pkg|apk|mar|nzp|dat|iop|xpi|dmg|dds|rar|thor|nar|gpf|lzma2)\??$
120960 90% 120960 ignore-no-store ignore-private override-e<br>
xpire store-stale override-lastmod<br>
</p>
<pre class="moz-signature" cols="72">
--
Atenciosamente,
Heiler Bensimon Bemerguy - CINBESA
Analista de Redes, Wi-Fi,
Virtualização e Serviços Internet
(55) 91 98151-4894</pre>
</body>
</html>