[squid-users] debug headers between squid --> website

[Alex Rousskov]

On 12/2/19 2:19 PM, Ahmad Alzaeem wrote:
> Can I do same  thing for https ?

Yes, you can. Squid logs CONNECT headers and also HTTP headers of
incoming and outgoing decrypted HTTPS requests. Squid does not see (and
cannot log) HTTP headers of encrypted traffic inside CONNECT tunnels
that are not bumped using the SslBump feature, of course.

Wireshark is often a better tool for header analysis because it makes it
easier to associate headers with connections and HTTP request-reply
exchanges. Wireshark can even handle encrypted-by-Squid traffic, but
that requires connection master keys that are not trivial to obtain.

Alex.


>> On Dec 2, 2019, at 10:03 PM, Alex Rousskov wrote:
>>
>> On 12/2/19 1:31 PM, Ahmad Alzaeem wrote:
>>
>>> Is it possible to run it from squid ?
>>
>> Packet catpure is usually better, especially for plain HTTP traffic, but
>> you can also get raw HTTP headers in cache.log if you set debug_options
>> in squid.conf to ALL,2
>>
>> Alex.
>>
>>
>>>> On Dec 2, 2019, at 8:58 PM, Antony Stone
>>>> <Antony.Stone at squid.open.source.it> wrote:
>>>>
>>>> On Monday 02 December 2019 at 18:34:31, Ahmad Alzaeem wrote:
>>>>
>>>>> Hello Tem ,
>>>>>
>>>>> How can i debug Headers that is between squid——> website request made
>>>>
>>>> Run a packet sniffer (tcpdump, wireshark, tshark...) on the Squid
>>>> server,
>>>> looking at the external interface (ie: the one pointing to the
>>>> website/s).
>>>>
>>>>> i need to see what squid send headers to website
>>>>> and what website reply o squid .
>>>>
>>>> So long as you're doing HTTP (as per your example) and not HTTPS,
>>>> any packet
>>>> sniffer and protocol analyser (wireshark is *very* good at this)
>>>> will show you
>>>> this quite easily.
>>>>
>>>>
>>>> Antony.
>>>>
>>>> -- 
>>>> Atheism is a non-prophet-making organisation.
>>>>
>>>>                                                  Please reply to the
>>>> list;
>>>>                                                        please
>>>> *don't* CC me.
>>>> _______________________________________________
>>>> squid-users mailing list
>>>> squid-users at lists.squid-cache.org
>>>> http://lists.squid-cache.org/listinfo/squid-users
>>> _______________________________________________
>>> squid-users mailing list
>>> squid-users at lists.squid-cache.org
>>> http://lists.squid-cache.org/listinfo/squid-users
>>>
>>
>> _______________________________________________
>> squid-users mailing list
>> squid-users at lists.squid-cache.org
>> http://lists.squid-cache.org/listinfo/squid-users