search

darold / squidanalyzer

Squid Analyzer parses Squid proxy access log and reports general statistics about hits, bytes, users, networks, top URLs, and top second level domains. Statistic reports are oriented toward user and bandwidth control.
http://squidanalyzer.darold.net/
126 stars 36 forks source link

TCP_TUNNEL for video steaming not figuring in reports ? #85

Closed Mang0uste closed 8 years ago

Mang0uste commented 9 years ago

Hello,

Since I have migrated my proxy from squid 3.3.x to 3.5.x I have noticed a change of behavior for streaming website access

I'm using squidanalyzer 6.1

in squid 3.5.x :

1434013402.812 49468 10.33.20.129 TCP_TUNNEL/200 2164668 CONNECT r12---sn-25ge7ner.googlevideo.com:443 - HIER_DIRECT/173.194.137.17 -

in squid 3.3.x :

1434013852.427 824 10.166.94.99 TCP_MISS/200 838 CONNECT r5---sn-25ge7n7s.googlevideo.com:443 - HIER_DIRECT/173.194.0.74 -

I know my users download 40GB of youtube streaming/da, and since I have migrated to squid 3.5.x well, on squidguard googlevideo.com do not even figures on the top 5 domain...

I'm available to provide extra information or whatever

Regards,

darold commented 9 years ago

Hi,

Thanks for the report, commit 2753031 might solves this issue. Perhaps it could be interesting to add streaming traffic clearly identified in the reports, any though?

Mang0uste commented 9 years ago

Hi Darold and thanks for the feedback.

It can be nice to have some entertaiment streaming traffic (radio/video) figuring in SA, endeed !

I'll installl your fix and have a test,

See ya

darold commented 8 years ago

I'm closing this issue as there's no mime_type information associated with TCP_TUNNEL report. In this case, video/audio streaming detection can only be done using an extra list of ip addresses/website, which is not possible with SquidAnalyzer. Some audio/video streaming traffic are still available with mime_type reports.