Есть Proxy сервер на SQUID, не является конечной точкой в сети, вход и выход один и тот же интерфейс.
Если смотреть трафик, идет дикая загрузка канала в рабочее время, из за прокси не понятно, кто его вешает. Как найти нарушителя? Связываем ситуацию с загрузками Windows 10 обновлений, но не факт. На что стоит обратить внимание?
Если смотреть на FireWall то нет никаких клиентов, кто бы грузил сеть. Как будто кто-то отправил запрос на Proxy, и тот начал качать себе всё, и никому не отдавать дальше.
На коммутаторах нет от клиентов такого большего трафика, максимум мегабит 5-6, и то редко, а тут стабильно до 50 мегабит, при канале интернет в 45. Скриншоты прилагаю.
И что за 88.221.132.80 ??? Чего от туда качает прокси, кто его просит?!
88.221.132.80 , в обще какой то странный веб сервер.
Конфиг:
#ACL WORK TIME
acl worktime time MTWHFA 08:30-22:30
#ACL Resources
acl bad_domains dstdomain "/etc/squid/block_domains.acl"
acl white_domains dstdomain "/etc/squid/white_domains.acl"
acl white_domains2 dstdomain "/etc/squid/white_domains2.acl"
acl block_extensions url_regex -i "/etc/squid/block_extensions.acl"
acl bad_url url_regex -i "/etc/squid/bad_url.acl"
#acl bad_mime rep_mime_type -i "/etc/squid/mime_type.acl"
acl wupdates url_regex -i "/etc/squid/wupdates.acl"
acl no_cache dstdomain "/etc/squid/nocache_domain.acl"
#ACL WINDOWS UPDATES
acl windowsupdate dstdomain "/etc/squid/wdomainupdates.acl"
#ACL Groups IP
acl managers src "/etc/squid/inet_users.acl"
acl sec_users src "/etc/squid/sec_users.acl"
acl sec_users2 src "/etc/squid/sec_users2.acl"
dns_nameservers 77.88.8.7 77.88.8.3 192.168.77.1
#ACL SYSTEMS
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
#acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl Safe_ports port 22 # webinars
acl Safe_ports port 757
acl Safe_ports port 3306 # webinars
acl Safe_ports port 4444 # webinars
acl Safe_ports port 4567 # webinars
acl Safe_ports port 8080 # webinars
acl Safe_ports port 8081 # webinars
acl Safe_ports port 8089 # webinars
acl Safe_ports port 8090 # webinars
acl Safe_ports port 8443 # webinars
acl Safe_ports port 8888 # webinars
acl Safe_ports port 9091 # webinars
acl Safe_ports port 1935 # Test
acl Safe_ports port 4343 # Test
acl Safe_ports port 4344 # Test
acl Safe_ports port 9443 # Test
acl Safe_ports port 17734 # Test
acl Safe_ports port 29980 # Test
acl Safe_ports port 2042 #mail agent
acl Safe_ports port 4244 # whatsapp
acl Safe_ports port 5222 # whatsapp
acl Safe_ports port 5223 # whatsapp
acl Safe_ports port 5228 # whatsapp
acl Safe_ports port 5242 # whatsapp
acl Safe_ports port 50318 # whatsapp
acl Safe_ports port 59234 # whatsapp
acl CONNECT method CONNECT
#HTTP ACCESS Windows UPDATE
http_access allow wupdates
acl CONNECT method CONNECT
acl wuCONNECT dstdomain www.update.microsoft.com
acl wuCONNECT dstdomain sls.microsoft.com
http_access allow CONNECT wuCONNECT managers
http_access allow windowsupdate managers
http_access allow CONNECT wuCONNECT sec_users
http_access allow windowsupdate sec_users
http_access allow CONNECT wuCONNECT localhost
http_access allow windowsupdate localhost
#HTTP ACCESS
http_access deny managers bad_domains
http_access deny managers block_extensions
#http_access deny managers bad_mime
http_access deny managers bad_url
#http_reply_access deny managers bad_mime
http_access allow sec_users white_domains
http_access allow sec_users2 white_domains2
http_access deny sec_users
http_access deny sec_users2
http_access deny managers !worktime
http_access allow managers
#HTTP CONF ACCESS
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager
http_access allow localhost
http_access deny all
# CONFIG SYSTEM
http_port 3128
coredump_dir /var/spool/squid
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
#### CACHE DENY (NOCACHE)#####
cache deny no_cache
##############################
#cache_dir aufs /var/spool/squid 500 49 256
cache_dir aufs /var/spool/squid 40000 16 256
cache_mem 200 MB
range_offset_limit 200 MB windowsupdate
maximum_object_size 200 MB
quick_abort_min -1
# MEM
maximum_object_size_in_memory 1024 KB
memory_replacement_policy lru
# LOG
logfile_rotate 10
log_icp_queries off
client_db off
buffered_logs on
half_closed_clients off
memory_pools off
cache_mgr admin@key.ru
# Cache ads #
#######################
refresh_pattern http://ad\. 43200 100% 43200 override-lastmod override-expire ignore-reload ignore-no-cache
refresh_pattern http://ads\. 43200 100% 43200 override-lastmod override-expire ignore-reload ignore-no-cache
refresh_pattern http://adv\. 43200 100% 43200 override-lastmod override-expire ignore-reload ignore-no-cache
refresh_pattern http://click\. 43200 100% 43200 override-lastmod override-expire ignore-reload ignore-no-cache
refresh_pattern http://count\. 43200 100% 43200 override-lastmod override-expire ignore-reload ignore-no-cache
refresh_pattern http://counter\. 43200 100% 43200 override-lastmod override-expire ignore-reload ignore-no-cache
refresh_pattern http://engine\. 43200 100% 43200 override-lastmod override-expire ignore-reload ignore-no-cache
refresh_pattern http://img\.readme\.ru 43200 100% 43200 override-lastmod override-expire ignore-reload ignore-no-cache
refresh_pattern http://userpic\.livejournal\.com 43200 100% 43200 override-lastmod override-expire ignore-reload ignore-no-cache
refresh_pattern \.ru/bf-analyze 43200 100% 43200 override-lastmod override-expire ignore-reload ignore-no-cache
refresh_pattern \.ru/bf-si 43200 100% 43200 override-lastmod override-expire ignore-reload ignore-no-cache
refresh_pattern /advs/ 43200 100% 43200 override-lastmod override-expire ignore-reload ignore-no-cache
refresh_pattern /banners/ 43200 100% 43200 override-lastmod override-expire ignore-reload ignore-no-cache
refresh_pattern /cgi-bin/iframe/ 43200 100% 43200 override-lastmod override-expire ignore-reload ignore-no-cache
Скрины:
Средний
Сложный
