[squid-users] TCP_TUNNEL_ABORTED/200 with spliced windows updates

[Amos Jeffries]

On 14/05/18 20:59, Ahmad, Sarfaraz wrote:
> Hi Folks,
> 
> I am using WCCP and redirecting traffic to Squid for both HTTP/HTTPS
> interception.
> 
> In this setup, I have spliced most of the Windows updates's services
> using SNI in squid's acls. Yet even with TCP tunnel, I am getting
> failures with these messages in the accesslog. 
> 
> Why could that response time be so high and is that causing the client
> to close the connection ? When I take the proxy out of the picture(no
> redirection through WCCP) the updates run just fine.
> 

1) A client may disconnect at any time, for any reason.

2) WCCP is not doing the interception part. It is routing packets to the
Squid box. The intercept should ONLY be done there.

3) Maybe those 3898 bytes that very consistently get delivered to the
client contain a hint.

  and/or, try the intercept part without WCCP if you can. Simplify the
network path and test each part independently to find the point of breakage.


Amos