[squid-users] Squid returns NONE_ABORTED/000 and high response time but the internet access itself looks okay

[Amos Jeffries]

On 07/08/18 21:55, Ahmad, Sarfaraz wrote:
> Hi,
> 
>  
> 
> I am WCCPv2 for redirecting traffic to Squid.
> 

Squid version?

> Intermittently I see these messages in access.log and the internet for
> clients goes away.
> 
>  
> 
> 1533612202.312  79102 <ip> NONE_ABORTED/000 0 CONNECT 198.22.156.64:443
> - HIER_NONE/- -
> 
> 1533612202.312  82632 <ip> NONE_ABORTED/000 0 CONNECT
> 173.194.142.186:443 - HIER_NONE/- -
> 
> 1533612202.312  16030 <ip> NONE_ABORTED/000 0 CONNECT 172.217.15.67:443
> - HIER_NONE/- -
> 
> 1533612202.312  78477 <ip> NONE_ABORTED/000 0 CONNECT
> 173.194.142.186:443 - HIER_NONE/- -
> 
>  
> 
> But I can access internet on the host running squid itself just fine yet
> Squid reports those messages with high response times (the second column).
> 
...>  
> 
> We use an ICAP service. Could that play a role here ?

A lot of things *might* play a role there.

> 
> Any thoughts ?

Trace the traffic.

What did the client actually send to Squid?
  It's probably not a port-80 style CONNECT request.

What does Squid send back to the client?

Does Squid complete the TLS handshake?

What are your SSL-Bump settings?


Amos