I have a Windows XP box running IE 6.0.2800 and it is configured to use my squid proxy at 192.168.44.1:3128. Everything appears to work fine from a user perspective.
I am blocking outbound port 80 at my firewall and whenever this PC is in use I see blocked port 80 attempts. I spent about 15 minutes this morning doing general browsing on that PC, and then checked the firewall log. I was surprised to find a large number of port 80 entries. There were only about 12 ip addresses, but all of them had multiple entries (50+). I looked in squid's access.log and quickly found 4 or 5 of the ip addresses listed for sites that I visited. Is it possible that while trying to load a page, IE would send most of the links using the proxy and send a few of them via port 80? That's how it looks to me. While I was browsing I did not notice red "x's" or other indications that items had not been loaded. Maybe it tried direct and then fell back to the proxy? (I'm not using a proxy.pac file; the proxy address and port has been entered.) I had tcpdump running at the time (looking for something else) so I have the requests captured, but looking at them doesn't do anything for me. As I was researching this I found that my squid version (2.4.STABLE6) is a little dated; could that have anything to do with this issue? Thanks in advance for your help! Rick
