Advanced
Mailing List Archive

Mailing List Archive

  1. Home >
  2. Varnish>
  3. Misc
Live test log files (1 of many)
phk at phk
Jul 9, 2006, 9:38 AM
Post #1 of 9 (1842 views)
Permalink
Anders,

I'm seeing some weird headers and just to make sure that it is not
varnish which messes things up, I would appreciate if you could
find out if you also see them in Squid.

Here are three examples:

--------------------
04 19 874 SessionOpen <165.21.154.111 3085>
1a 10 874 XID <1211144113>
0e 3 874 Request <GET>
12 15 874 URL </sistenytt.html>
13 8 874 Protocol <HTTP/1.1>
14 15 874 Header <Host: www.vg.no>
14 37 874 Header <User-Agent: Mozilla/4.0 (compatible;)>
14 22 874 Header <Accept: text/html, */*>
14 61 874 Header <If-Modified-Since: Fri, 07 Jul 2006 07:35:27 GMT; leng
th=1730>
14 36 874 Header <If-None-Match: "1a89b4-6c2-44ae0ebf">
14 26 874 Header <Cache-Control: max-stale=0>
14 17 874 Header <Cneonction: close>
^^^^^^^^^^^
14 32 874 Header <X-BlueCoat-Via: 38E8F7FA07E482A8>
14 22 874 Header <Connection: Keep-Alive>
14 32 874 Header <X-Forwarded-For: 165.21.154.132>
17 4 874 VCL_call <recv 1 4.14 2 5.9 5 8.5 6 8.9 7 8.34 9 11.5 lookup>
1b 10 874 Hit <1210949324>
17 3 874 VCL_call <hit 10 14.13 11 15.9 13 18.5 deliver>
11 3 874 Status <200>
10 4 874 Length <1744>
05 19 874 SessionReuse <165.21.154.111 3085>
--------------------
04 21 497 SessionOpen <213.161.240.187 12927>
1a 10 497 XID <1210954928>
0e 3 497 Request <GET>
12 14 497 URL </css/hoved.css>
13 8 497 Protocol <HTTP/1.1>
14 11 497 Header <Accept: */*>
14 52 497 Header <Weferer: SQHYUCDDJBLVLMHAALPTCXLYRWTQTIPWIGYOKSTTZRC>
^^^^^^^
14 19 497 Header <Accept-Language: no>
14 30 497 Header <Accept-Encoding: gzip, deflate>
14 97 497 Header <User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows
NT 5.1; FunWebProducts; .NET CLR 1.1.4322)>
14 15 497 Header <Host: www.vg.no>
14 22 497 Header <Connection: Keep-Alive>
17 4 497 VCL_call <recv 1 4.14 2 5.9 5 8.5 6 8.9 7 8.34 9 11.5 lookup>
1b 10 497 Hit <1210949321>
17 3 497 VCL_call <hit 10 14.13 11 15.9 13 18.5 deliver>
11 3 497 Status <200>
10 4 497 Length <6801>
05 21 497 SessionReuse <213.161.240.187 12927>
--------------------
04 18 869 SessionOpen <62.16.181.213 6057>
1a 10 869 XID <1210962197>
0e 3 869 Request <GET>
12 15 869 URL </sistenytt.html>
13 8 869 Protocol <HTTP/1.0>
14 15 869 Header <Host: www.vg.no>
14 102 869 Header <User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; e
n-US; rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.4>
14 107 869 Header <Accept: text/xml,application/xml,application/xhtml+xml
,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5>
14 31 869 Header <Accept-Language: en-us,en;q=0.5>
14 29 869 Header <Accept-EncodXng: gzip,deflate>
^^^^^^^^^^^^^^^
14 46 869 Header <Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7>
14 15 869 Header <Keep-Alive: 300>
14 22 869 Header <Connection: keep-alive>
14 16 869 Header <Pragma: no-cache>
14 23 869 Header <Cache-Control: no-cache>
17 4 869 VCL_call <recv 1 4.14 2 5.9 5 8.5 6 8.9 7 8.34 9 11.5 lookup>
1b 10 869 Hit <1210949324>
17 3 869 VCL_call <hit 10 14.13 11 15.9 13 18.5 deliver>
11 3 869 Status <200>
10 4 869 Length <1744>
06 12 869 SessionClose <not HTTP/1.1>
--------------------




--
Poul-Henning Kamp | UNIX since Zilog Zeus 3.20
phk at FreeBSD.ORG | TCP/IP since RFC 956
FreeBSD committer | BSD since 4.3-tahoe
Never attribute to malice what can adequately be explained by incompetence.
Live test log files (1 of many) [ In reply to ]
andersb at vgnett
Jul 11, 2006, 3:29 AM
Post #2 of 9 (1828 views)
Permalink
>Date: Sun, 09 Jul 2006 16:38:33 +0000
>From: "Poul-Henning Kamp" <phk at phk.freebsd.dk>
>Subject: To: varnish-misc at projects.linpro.no
>Message-ID: <65004.1152463113 at critter.freebsd.dk>
>
>Anders,
>
>I'm seeing some weird headers and just to make sure that it is not
>varnish which messes things up, I would appreciate if you could
>find out if you also see them in Squid.

Wow, they look strange, to say the least.
I am not sure how to debug this in Squid, without makeing _huge_ log
files, but maybe I should do just that...

Right now though I am home with a back that has gotten worse and worse :((
So I won't be able to do this for some time.

So right now I put this on hold.

Anders Berg

>Here are three examples:

--------------------
04 19 874 SessionOpen <165.21.154.111 3085>
1a 10 874 XID <1211144113>
0e 3 874 Request <GET>
12 15 874 URL </sistenytt.html>
13 8 874 Protocol <HTTP/1.1>
14 15 874 Header <Host: www.vg.no>
14 37 874 Header <User-Agent: Mozilla/4.0 (compatible;)>
14 22 874 Header <Accept: text/html, */*>
14 61 874 Header <If-Modified-Since: Fri, 07 Jul 2006 07:35:27
GMT; leng
th=1730>
14 36 874 Header <If-None-Match: "1a89b4-6c2-44ae0ebf">
14 26 874 Header <Cache-Control: max-stale=0>
14 17 874 Header <Cneonction: close>
^^^^^^^^^^^
14 32 874 Header <X-BlueCoat-Via: 38E8F7FA07E482A8>
14 22 874 Header <Connection: Keep-Alive>
14 32 874 Header <X-Forwarded-For: 165.21.154.132>
17 4 874 VCL_call <recv 1 4.14 2 5.9 5 8.5 6 8.9 7 8.34 9 11.5 lookup>
1b 10 874 Hit <1210949324>
17 3 874 VCL_call <hit 10 14.13 11 15.9 13 18.5 deliver>
11 3 874 Status <200>
10 4 874 Length <1744>
05 19 874 SessionReuse <165.21.154.111 3085>
--------------------
04 21 497 SessionOpen <213.161.240.187 12927>
1a 10 497 XID <1210954928>
0e 3 497 Request <GET>
12 14 497 URL </css/hoved.css>
13 8 497 Protocol <HTTP/1.1>
14 11 497 Header <Accept: */*>
14 52 497 Header <Weferer:
SQHYUCDDJBLVLMHAALPTCXLYRWTQTIPWIGYOKSTTZRC>
^^^^^^^
14 19 497 Header <Accept-Language: no>
14 30 497 Header <Accept-Encoding: gzip, deflate>
14 97 497 Header <User-Agent: Mozilla/4.0 (compatible; MSIE 6.0;
Windows
NT 5.1; FunWebProducts; .NET CLR 1.1.4322)>
14 15 497 Header <Host: www.vg.no>
14 22 497 Header <Connection: Keep-Alive>
17 4 497 VCL_call <recv 1 4.14 2 5.9 5 8.5 6 8.9 7 8.34 9 11.5 lookup>
1b 10 497 Hit <1210949321>
17 3 497 VCL_call <hit 10 14.13 11 15.9 13 18.5 deliver>
11 3 497 Status <200>
10 4 497 Length <6801>
05 21 497 SessionReuse <213.161.240.187 12927>
--------------------
04 18 869 SessionOpen <62.16.181.213 6057>
1a 10 869 XID <1210962197>
0e 3 869 Request <GET>
12 15 869 URL </sistenytt.html>
13 8 869 Protocol <HTTP/1.0>
14 15 869 Header <Host: www.vg.no>
14 102 869 Header <User-Agent: Mozilla/5.0 (Windows; U; Windows NT
5.1; e
n-US; rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.4>
14 107 869 Header <Accept:
text/xml,application/xml,application/xhtml+xml
,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5>
14 31 869 Header <Accept-Language: en-us,en;q=0.5>
14 29 869 Header <Accept-EncodXng: gzip,deflate>
^^^^^^^^^^^^^^^
14 46 869 Header <Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7>
14 15 869 Header <Keep-Alive: 300>
14 22 869 Header <Connection: keep-alive>
14 16 869 Header <Pragma: no-cache>
14 23 869 Header <Cache-Control: no-cache>
17 4 869 VCL_call <recv 1 4.14 2 5.9 5 8.5 6 8.9 7 8.34 9 11.5 lookup>
1b 10 869 Hit <1210949324>
17 3 869 VCL_call <hit 10 14.13 11 15.9 13 18.5 deliver>
11 3 869 Status <200>
10 4 869 Length <1744>
06 12 869 SessionClose <not HTTP/1.1>
--------------------
Live test log files (1 of many) [ In reply to ]
des at linpro
Jul 11, 2006, 3:38 AM
Post #3 of 9 (1823 views)
Permalink
"Anders Berg" <andersb at vgnett.no> writes:
> "Poul-Henning Kamp" <phk at phk.freebsd.dk> writes:
> > I'm seeing some weird headers and just to make sure that it is not
> > varnish which messes things up, I would appreciate if you could
> > find out if you also see them in Squid.
> Wow, they look strange, to say the least.
> I am not sure how to debug this in Squid, without makeing _huge_ log
> files, but maybe I should do just that...

An alternative would be to run Varnish at a low load and capture a
tcpdump of the traffic between Varnish and the backend. If / when we
see strange headers in the log again, we can check the tcpdump to see
whteher they were received that way from the backend or mangled by
Varnish.

DES
--
Dag-Erling Sm?rgrav
Senior Software Developer
Linpro AS - www.linpro.no
Live test log files (1 of many) [ In reply to ]
phk at phk
Jul 11, 2006, 4:05 AM
Post #4 of 9 (1815 views)
Permalink
In message <1452.193.213.34.102.1152613756.squirrel at denise.vg.no>, "Anders Berg
" writes:

>Right now though I am home with a back that has gotten worse and worse :((
>So I won't be able to do this for some time.
>
>So right now I put this on hold.

Good to see that you keep your priorities straight.

>14 17 874 Header <Cneonction: close>
> ^^^^^^^^^^^

This one I have found on the net, it's not our fault.

--
Poul-Henning Kamp | UNIX since Zilog Zeus 3.20
phk at FreeBSD.ORG | TCP/IP since RFC 956
FreeBSD committer | BSD since 4.3-tahoe
Never attribute to malice what can adequately be explained by incompetence.
Live test log files (1 of many) [ In reply to ]
phk at phk
Jul 11, 2006, 4:09 AM
Post #5 of 9 (1823 views)
Permalink
In message <ujrhd1opgtk.fsf at cat.linpro.no>, Dag-Erling =?iso-8859-1?Q?Sm=F8rgra
v?= writes:
>"Anders Berg" <andersb at vgnett.no> writes:
>> "Poul-Henning Kamp" <phk at phk.freebsd.dk> writes:
>> > I'm seeing some weird headers and just to make sure that it is not
>> > varnish which messes things up, I would appreciate if you could
>> > find out if you also see them in Squid.
>> Wow, they look strange, to say the least.
>> I am not sure how to debug this in Squid, without makeing _huge_ log
>> files, but maybe I should do just that...
>
>An alternative would be to run Varnish at a low load and capture a
>tcpdump of the traffic between Varnish and the backend.

These headers were on the client side though.


--
Poul-Henning Kamp | UNIX since Zilog Zeus 3.20
phk at FreeBSD.ORG | TCP/IP since RFC 956
FreeBSD committer | BSD since 4.3-tahoe
Never attribute to malice what can adequately be explained by incompetence.
Live test log files (1 of many) [ In reply to ]
des at linpro
Jul 11, 2006, 4:15 AM
Post #6 of 9 (1816 views)
Permalink
"Poul-Henning Kamp" <phk at phk.freebsd.dk> writes:
> Dag-Erling Sm?rgrav <des at linpro.no> writes:
> > An alternative would be to run Varnish at a low load and capture a
> > tcpdump of the traffic between Varnish and the backend.
> These headers were on the client side though.

OK, I thought they came from the backend.

Weird headers from clients are a fact of life, I guess. It would
still be interesting to get a tcpdump to confirm that it isn't Varnish
mangling incoming requests, but I'm a lot less worried than if it had
been on the backend side.

DES
--
Dag-Erling Sm?rgrav
Senior Software Developer
Linpro AS - www.linpro.no
Live test log files (1 of many) [ In reply to ]
phk at phk
Jul 11, 2006, 4:24 AM
Post #7 of 9 (1823 views)
Permalink
In message <ujrac7gpf2x.fsf at cat.linpro.no>, Dag-Erling =?iso-8859-1?Q?Sm=F8rgra
v?= writes:
>"Poul-Henning Kamp" <phk at phk.freebsd.dk> writes:
>> Dag-Erling Sm?rgrav <des at linpro.no> writes:
>> > An alternative would be to run Varnish at a low load and capture a
>> > tcpdump of the traffic between Varnish and the backend.
>> These headers were on the client side though.
>
>OK, I thought they came from the backend.
>
>Weird headers from clients are a fact of life, I guess. It would
>still be interesting to get a tcpdump to confirm that it isn't Varnish
>mangling incoming requests, but I'm a lot less worried than if it had
>been on the backend side.

Same here. All of them look like plausible, so I'm not worried, but
if Anders had an easy way to verify it would have been nice.

I guess we can verify with a tcpdump at some point.

--
Poul-Henning Kamp | UNIX since Zilog Zeus 3.20
phk at FreeBSD.ORG | TCP/IP since RFC 956
FreeBSD committer | BSD since 4.3-tahoe
Never attribute to malice what can adequately be explained by incompetence.
Live test log files (1 of many) [ In reply to ]
des at linpro
Jul 11, 2006, 4:44 AM
Post #8 of 9 (1814 views)
Permalink
"Poul-Henning Kamp" <phk at phk.freebsd.dk> writes:
> Same here. All of them look like plausible, so I'm not worried, but
> if Anders had an easy way to verify it would have been nice.

Could they be caused by single-bit errors?

DES
--
Dag-Erling Sm?rgrav
Senior Software Developer
Linpro AS - www.linpro.no
Live test log files (1 of many) [ In reply to ]
phk at phk
Jul 11, 2006, 4:46 AM
Post #9 of 9 (1828 views)
Permalink
In message <ujr64i4pdrw.fsf at cat.linpro.no>, Dag-Erling =?iso-8859-1?Q?Sm=F8rgra
v?= writes:
>"Poul-Henning Kamp" <phk at phk.freebsd.dk> writes:
>> Same here. All of them look like plausible, so I'm not worried, but
>> if Anders had an easy way to verify it would have been nice.
>
>Could they be caused by single-bit errors?

I don't think so. The Connection: manglement seems to be the output
of some sort of commercial accellerator. The others looks like somebody
did a binary edit of their browser for (mostly) ideological reasons.

--
Poul-Henning Kamp | UNIX since Zilog Zeus 3.20
phk at FreeBSD.ORG | TCP/IP since RFC 956
FreeBSD committer | BSD since 4.3-tahoe
Never attribute to malice what can adequately be explained by incompetence.

©2024 GT.net. A Gossamer Threads company.
5th Floor, 455 Granville St., Vancouver, BC V6C 1T1, Canada | Legal