<html><head></head><body><div class="ydp5e6f5da7yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:16px;">
<div dir="ltr" data-setdir="false">Well in my case for my single web request in first CONNECT log entry, the domain address is IP address of server and URL is IP:PORT of server and in second log entry domain is example.com and URL is example.com:443 .</div><div dir="ltr" data-setdir="false">but why? I dont undrestand it, this confuses me !!<br><div>I dont bump anything in this requests!</div><div dir="ltr" data-setdir="false">If I use <span><em>ssl::server_name</em></span> and specify IP address of server <span>to bump https request, </span> my https://example.com request will be blocked, I dont send requests in the example format of <a href="https://1.1.1.1" rel="nofollow" target="_blank">https://1.1.1.1</a> .but they will be blocked while I dont want to.<br></div></div><div dir="ltr" data-setdir="false"><br></div>
</div><div id="yahoo_quoted_8384716733" class="yahoo_quoted">
<div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:13px;color:#26282a;">
<div>
On Monday, April 20, 2020, 11:39:23 PM GMT+4:30, Alex Rousskov <rousskov@measurement-factory.com> wrote:
</div>
<div><br></div>
<div><br></div>
<div><div dir="ltr">On 4/20/20 2:04 PM, <a shape="rect" ymailto="mailto:leomessi983@yahoo.com" href="mailto:leomessi983@yahoo.com">leomessi983@yahoo.com</a> wrote:<div class="yqt1256381211" id="yqtfd44918"><br clear="none">> hi<br clear="none">> I have one question.<br clear="none">> why for each https request that squid do peek or bump or splice ,squid<br clear="none">> logs 2 lines?<br clear="none">> one with connect method and one with head method?</div><br clear="none"><br clear="none">... because there are two HTTP[S] requests in those cases, one with the<br clear="none">CONNECT method and one with the HEAD method. There are other cases where<br clear="none">one bumped CONNECT tunnel carries hundreds or even thousands of<br clear="none">GET/HEAD/PUT/POST/CONNECT/etc. requests. And there are also cases where<br clear="none">a bumped CONNECT tunnel carries no requests at all.<br clear="none"><br clear="none">In summary, one bumped CONNECT tunnel will (by default) result in one or<br clear="none">more access.log records, starting with the CONNECT record.<br clear="none"><br clear="none">Alex.<div class="yqt1256381211" id="yqtfd35216"><br clear="none"></div></div></div>
</div>
</div></body></html>