[squid-users] Understand GOOGLEVIDEO Url from access.log

[Ralf Hildebrandt]

* Bjoern Meier <bjoern.meier at gmail.com>:
> hi,
> 
> Ralf Hildebrandt <Ralf.Hildebrandt at charite.de> schrieb am Di., 10. Mai 2016
> um 11:10 Uhr:
> 
> > * alesironi <alesironi at yahoo.it>:
> >
> > > The problem is that on Squid log file (ACCESS.LOG) the URL I see is
> > similar
> > > to this:
> > >
> > > r10---sn-4g57knd7.googlevideo.com:443
> >
> > 443 = https = encrypted
> >
> > meaning: You cannot know.
> 
> 
> Wait. Since when track Squid  data?  Squid only track connections in the
> access.log (that's why it is called access.log).
> So, it is not importent if the data is encrypted, the connection data can't
> be encrypted.

With HTTPS, all you see is CONNECT requests and target hosts:

1462872328.675 059737 10.x.x.x TCP_TUNNEL/200 2987 CONNECT www.adsensecustomsearchads.com:443 - HIER_DIRECT/216.58.213.238 - 31123
1462872362.553 058061 141.42.x.x TCP_TUNNEL/200 752 CONNECT www.google-analytics.com:443 - HIER_DIRECT/216.58.213.238 - 34542

-- 
Ralf Hildebrandt                   Charite Universitätsmedizin Berlin
ralf.hildebrandt at charite.de        Campus Benjamin Franklin
http://www.charite.de              Hindenburgdamm 30, 12203 Berlin
Geschäftsbereich IT, Abt. Netzwerk fon: +49-30-450.570.155