Does Squid send packets to port 7 (echo)? If so, why?
It may. This is an old feature from the Harvest cache software. The cache would send ICP “SECHO” message to the echo ports of origin servers. If the SECHO message came back before any of the other ICP replies, then it meant the origin server was probably closer than any neighbor cache. In that case Harvest/Squid sent the request directly to the origin server. With more attention focused on security, many administrators filter UDP packets to port 7. The Computer Emergency Response Team (CERT) once issued an advisory note ( CA-96.01: UDP Port Denial-of-Service Attack) that says UDP echo and chargen services can be used for a denial of service attack. This made admins extremely nervous about any packets hitting port 7 on their systems, and they made complaints. The source_ping feature has been disabled in Squid-2. If you’re seeing packets to port 7 that are coming from a Squid cache (remote port 3130), then its probably a very old version of Squid.
It may. This is an old feature from the Harvest cache software. The cache would send ICP “SECHO” message to the echo ports of origin servers. If the SECHO message came back before any of the other ICP replies, then it meant the origin server was probably closer than any neighbor cache. In that case Harvest/Squid sent the request directly to the origin server.
It may. This is an old feature from the Harvest cache software. The cache would send ICP “SECHO” message to the echo ports of origin servers. If the SECHO message came back before any of the other ICP replies, then it meant the origin server was probably closer than any neighbor cache. In that case Harvest/Squid sent the request directly to the origin server. With more attention focused on security, many administrators filter UDP packets to port 7. The Computer Emergency Response Team (CERT) once issued an advisory note ( CA-96.01: UDP Port Denial-of-Service Attack) that says UDP echo and chargen services can be used for a denial of service attack. This made admins extremely nervous about any packets hitting port 7 on their systems, and they made complaints. The source_ping feature has been disabled in Squid-2. If you’re seeing packets to port 7 that are coming from a Squid cache (remote port 3130), then its probably a very old version of Squid.
