Hello,
I have SME 7.2 at a school in Server/Gateway mode over a T1 line.
The past few days I have noticed very slow web browsing with frequent timeouts and page cannot be displayed.
Our ISP claims everything is normal at their end and T1 is working OK.
Our local network also appears normal.
I looked in SME message logs and observed some unusual errors:
Jan 8 05:05:51 squid[4271]: sslReadServer: FD 16: read failure: (104) Connection reset by peer
Jan 8 05:09:32 squid[4271]: sslReadServer: FD 14: read failure: (104) Connection reset by peer
Jan 8 05:11:04 squid[4271]: sslReadServer: FD 17: read failure: (104) Connection reset by peer
Jan 8 05:20:33 squid[4271]: sslReadServer: FD 18: read failure: (104) Connection reset by peer
Jan 8 05:29:42 squid[4271]: sslReadServer: FD 16: read failure: (104) Connection reset by peer
These errors repeated frequently throughout the last few days.
I Also observed a strange DHCP error:
Jan 8 10:53:38 dhcpd: DHCPINFORM from 4.0.0.0 via eth0: unknown subnet 0.0.0.0
Our local network is all DHCP on a 192.168.x.x subnet.
I shutdown Squid then flushed the cache and restarted per the Wiki instructions and it seemed to help temporarily.
However I am again seeing the SSLReadServer errors sporadically.
Could this be a hacker from outside trying to hack my SME or relay through Squid to attack some website?
I will appreciate any advice as I am somewhat at a loss.
I can submit a bugtracker if necessary.
1 Replies
1570 Views