[squid-users] Question about traffic calculate

[Amos Jeffries]

On 05/06/18 11:34, Tiraen wrote:
> Good day. I apologize in advance if this has already been discussed, if
> so - just give a link to the discussion
> 
> The proxy server has an interface for viewing current active sessions
> 
> http://{}:{}/squid-internal-mgr/active_requests 
> 

Please be aware these are *not* "sessions". These are transactions,
which  have one request, one response, and maybe some informational
messages.

A "session" as far as it relates to HTTP is a application level thing
which includes _multiple_ transactions, and possibly even multiple TCP
connections at the client end.


> or
> 
> cache_object://%s/active_requests
> 
> There there is some set of parameters which allow to get the data on traffic
> 
> If the connection to the proxy goes directly and by http we see like this:
> 
> /Connection: 0x8050e0518/
> /        FD 29, read 4247, wrote 13479/
> /        FD desc: Reading next request/
> /        in: buf 0x8045a6fe0, used 0, free 39/
> /        remote: ХХХХ:50340/
> /        local: ХХХХ:8080/
> /        nrequests: 1/
> /uri ХХХ:443/
> /logType TCP_TUNNEL/
> /out.offset 0, out.size 13440/
> /req_sz 235/
> /entry 0x0/N/A/
> /start 1527608373.902584 (73.252258 seconds ago)/
> /username -/
> /delay_pool 0/
> 
> 
> We have both traffic stat
> 
> /out.offset 0, out.size 13440/
> /req_sz 235/
> 

The latest transactions request was 235 bytes, its reply was 13440 bytes
(so far).


> But if there is a frontend in front of the SQUID (nghttpx for example
> and https) 
> 
> we have this
> 
> /Connection: 0x7f66a317ecf8/
> /    FD 222, read 9192, wrote 526/
> /    FD desc: Reading next request/
> /    in: buf 0x7f66a294fb90, used 0, free 39/
> /    remote: 127.0.0.1:2314 <http://127.0.0.1:2314>/
> /    local: 127.0.0.1:8081 <http://127.0.0.1:8081>/
> /    nrequests: 2/
> /uri nererut.com:443 <http://nererut.com:443>/
> /logType TAG_NONE/
> /out.offset 0, out.size 0/
> /req_sz 334/
> /entry (nil)/N/A/
> /start 1527526715.189831 (81017.831772 seconds ago)/
> /username 8355fcec-94fd-496c-94d1-a195a5ca7148/
> /delay_pool 0
> /
> without out traffic
> 
> /out.offset 0, out.size 0/
> /req_sz 334/

This transaction request was 334 bytes, its reply was 0 bytes (so far).


> 
> I certainly did not test why it happens - due to https or proxy, but is
> it possible to clarify this case?

The first transaction has reached the stage where a reply has started.

The second transaction has not yet reached that state despite 81017sec
having past.

That is all we can say without more information about things like for
example, which Squid version you are using, whether you are SSL-Bumping
the HTTPS traffic for either of those transactions, network topology on
the outgoing side of Squid, etc.


Amos