[unisog] machines requesting ident.cab

Rich Graves rcgraves at brandeis.edu
Thu Oct 31 23:34:04 GMT 2002


On 1 Nov 2002, Russell Fulton wrote:

> 	We were alerted to a strange phenomena yesterday when our squid proxy
> logs filled up the partition.  We found that several machines on campus
> were making tens ( and in one case hundreds) of thousands of requests
> for
> 
>  http://windowsupdate.microsoft.com/ident.cab
> Any ideas what is going on?

I think this is normal behavior.

shExpMatch(url, "*windowsupdate*") is told to go DIRECT here. Never took 
the time to figure out whose fault it is.

I've also observed infinite loops on urls like
GET http://download.windowsupdate.com/msdownload/update/v3-19990518/CabPool/Q329834_WXP_SP2_x86_3AC87C6443D5CCC79FECEAA5661130DE250A8CE6.exe@10954-31586@
GET http://download.windowsupdate.com/msdownload/update/v3-19990518/CabPool/Q329834_WXP_SP2_x86_3AC87C6443D5CCC79FECEAA5661130DE250A8CE6.exe@31587-72880@
-- 
Rich Graves <rcgraves at brandeis.edu>
UNet Systems Administrator



More information about the unisog mailing list