SQUID Frequently Asked Questions

© 2001 Duane Wessels, wessels@squid-cache.org

You can download the FAQ as compressed Postscript, plain text, linuxdoc SGML source or as a compressed tar of HTML.

1. About Squid, this FAQ, and other Squid information resources

• 1.1 What is Squid?
• 1.2 What is Internet object caching?
• 1.3 Why is it called Squid?
• 1.4 What is the latest version of Squid?
• 1.5 Who is responsible for Squid?
• 1.6 Where can I get Squid?
• 1.7 What Operating Systems does Squid support?
• 1.8 Does Squid run on Windows NT?
• 1.9 What Squid mailing lists are available?
• 1.10 I can't figure out how to unsubscribe from your mailing list.
• 1.11 What Squid web pages are available?
• 1.12 Does Squid support SSL/HTTPS/TLS?
• 1.13 What's the legal status of Squid?
• 1.14 Is Squid year-2000 compliant?
• 1.15 Can I pay someone for Squid support?
• 1.16 Squid FAQ contributors
• 1.17 About This Document

2. Getting and Compiling Squid

• 2.1 Which file do I download to get Squid?
• 2.2 How do I compile Squid?
• 2.3 What kind of compiler do I need?
• 2.4 What else do I need to compile Squid?
• 2.5 Do you have pre-compiled binaries available?
• 2.6 How do I apply a patch or a diff?
• 2.7 configure options
• 2.8 undefined reference to __inet_ntoa
• 2.9 How can I get true DNS TTL info into Squid's IP cache?
• 2.10 My platform is BSD/OS or BSDI and I can't compile Squid
• 2.11 Problems compiling libmiscutil.a on Solaris
• 2.12 I have problems compiling Squid on Platform Foo.
• 2.13 I see a lot warnings while compiling Squid.
• 2.14 Building Squid on OS/2

3. Installing and Running Squid

• 3.1 How big of a system do I need to run Squid?
• 3.2 How do I install Squid?
• 3.3 What does the squid.conf file do?
• 3.4 Do you have a squid.conf example?
• 3.5 How do I start Squid?
• 3.6 How do I start Squid automatically when the system boots?
• 3.7 How do I tell if Squid is running?
• 3.8 squid command line options
• 3.9 How do I see how Squid works?

4. Configuration issues

• 4.1 How do I join a cache hierarchy?
• 4.2 How do I join NLANR's cache hierarchy?
• 4.3 Why should I want to join NLANR's cache hierarchy?
• 4.4 How do I register my cache with NLANR's registration service?
• 4.5 How do I find other caches close to me and arrange parent/child/sibling relationships with them?
• 4.6 My cache registration is not appearing in the Tracker database.
• 4.7 What is the httpd-accelerator mode?
• 4.8 How do I configure Squid to work behind a firewall?
• 4.9 How do I configure Squid forward all requests to another proxy?
• 4.10 I have dnsserver processes that aren't being used, should I lower the number in squid.conf?
• 4.11 My dnsserver average/median service time seems high, how can I reduce it?
• 4.12 How can I easily change the default HTTP port?
• 4.13 Is it possible to control how big each cache_dir is?
• 4.14 What cache_dir size should I use?
• 4.15 I'm adding a new cache_dir. Will I lose my cache?
• 4.16 Squid and http-gw from the TIS toolkit.
• 4.17 What is ``HTTP_X_FORWARDED_FOR''? Why does squid provide it to WWW servers, and how can I stop it?
• 4.18 Can Squid anonymize HTTP requests?
• 4.19 Can I make Squid go direct for some sites?
• 4.20 Can I make Squid proxy only, without caching anything?
• 4.21 Can I prevent users from downloading large files?

5. Communication between browsers and Squid

• 5.1 Netscape manual configuration
• 5.2 Netscape automatic configuration
• 5.3 Lynx and Mosaic configuration
• 5.4 Redundant Proxy Auto-Configuration
• 5.5 Proxy Auto-Configuration with URL Hashing
• 5.6 Microsoft Internet Explorer configuration
• 5.7 Netmanage Internet Chameleon WebSurfer configuration
• 5.8 Opera 2.12 proxy configuration
• 5.9 How do I tell Squid to use a specific username for FTP urls?
• 5.10 Configuring Browsers for WPAD
• 5.11 IE 5.0x crops trailing slashes from FTP URL's

6. Squid Log Files

• 6.1 squid.out
• 6.2 cache.log
• 6.3 useragent.log
• 6.4 store.log
• 6.5 hierarchy.log
• 6.6 access.log
• 6.7 Squid result codes
• 6.8 HTTP status codes
• 6.9 Request methods
• 6.10 Hierarchy Codes
• 6.11 cache/log (Squid-1.x)
• 6.12 swap.state (Squid-2.x)
• 6.13 Which log files can I delete safely?
• 6.14 How can I disable Squid's log files?
• 6.15 My log files get very big!
• 6.16 I want to use another tool to maintain the log files.
• 6.17 Managing log files
• 6.18 Why do I get ERR_NO_CLIENTS_BIG_OBJ messages so often?
• 6.19 What does ERR_LIFETIME_EXP mean?
• 6.20 Retrieving ``lost'' files from the cache
• 6.21 Can I use store.log to figure out if a response was cachable?

7. Operational issues

• 7.1 How do I see system level Squid statistics?
• 7.2 How can I find the biggest objects in my cache?
• 7.3 I want to restart Squid with a clean cache
• 7.4 How can I proxy/cache Real Audio?
• 7.5 How can I purge an object from my cache?
• 7.6 Using ICMP to Measure the Network
• 7.7 Why are so few requests logged as TCP_IMS_MISS?
• 7.8 How can I make Squid NOT cache some servers or URLs?
• 7.9 How can I delete and recreate a cache directory?
• 7.10 Why can't I run Squid as root?
• 7.11 Can you tell me a good way to upgrade Squid with minimal downtime?
• 7.12 Can Squid listen on more than one HTTP port?

8. Memory

• 8.1 Why does Squid use so much memory!?
• 8.2 How can I tell how much memory my Squid process is using?
• 8.3 My Squid process grows without bounds.
• 8.4 I set cache_mem to XX, but the process grows beyond that!
• 8.5 How do I analyze memory usage from the cache manger output?
• 8.6 The ``Total memory accounted'' value is less than the size of my Squid process.
• 8.7 xmalloc: Unable to allocate 4096 bytes!
• 8.8 fork: (12) Cannot allocate memory
• 8.9 What can I do to reduce Squid's memory usage?
• 8.10 Using an alternate malloc library.
• 8.11 How much memory do I need in my Squid server?

9. The Cache Manager

• 9.1 What is the cache manager?
• 9.2 How do you set it up?
• 9.3 Cache manager configuration for CERN httpd 3.0
• 9.4 Cache manager configuration for Apache
• 9.5 Cache manager configuration for Roxen 2.0 and later
• 9.6 Cache manager ACLs in squid.conf
• 9.7 Why does it say I need a password and a URL?
• 9.8 I want to shutdown the cache remotely. What's the password?
• 9.9 How do I make the cache host default to my cache?
• 9.10 What's the difference between Squid TCP connections and Squid UDP connections?
• 9.11 It says the storage expiration will happen in 1970!
• 9.12 What do the Meta Data entries mean?
• 9.13 In the utilization section, what is Other?
• 9.14 In the utilization section, why is the Transfer KB/sec
• 9.15 In the utilization section, what is the Object Count?
• 9.16 In the utilization section, what is the Max/Current/Min KB?
• 9.17 What is the I/O section about?
• 9.18 What is the Objects section for?
• 9.19 What is the VM Objects section for?
• 9.20 What does AVG RTT mean?
• 9.21 In the IP cache section, what's the difference between a hit, a negative hit and a miss?
• 9.22 What do the IP cache contents mean anyway?
• 9.23 What is the fqdncache and how is it different from the ipcache?
• 9.24 What does ``Page faults with physical i/o: 4897'' mean?
• 9.25 What does the IGNORED field mean in the 'cache server list'?

10. Access Controls

• 10.1 Introduction
• 10.2 How do I allow my clients to use the cache?
• 10.3 how do I configure Squid not to cache a specific server?
• 10.4 How do I implement an ACL ban list?
• 10.5 How do I block specific users or groups from accessing my cache?
• 10.6 Do you have a CGI program which lets users change their own proxy passwords?
• 10.7 Is there a way to do ident lookups only for a certain host and compare the result with a userlist in squid.conf?
• 10.8 Common Mistakes
• 10.9 I set up my access controls, but they don't work! why?
• 10.10 Proxy-authentication and neighbor caches
• 10.11 Is there an easy way of banning all Destination addresses except one?
• 10.12 Does anyone have a ban list of porn sites and such?
• 10.13 Squid doesn't match my subdomains
• 10.14 Why does Squid deny some port numbers?
• 10.15 Does Squid support the use of a database such as mySQL for storing the ACL list?
• 10.16 How can I allow a single address to access a specific URL?
• 10.17 How can I allow some clients to use the cache at specific times?
• 10.18 How can I allow some users to use the cache at specific times?
• 10.19 Problems with IP ACL's that have complicated netmasks
• 10.20 Can I set up ACL's based on MAC address rather than IP?
• 10.21 Debugging ACLs
• 10.22 Can I limit the number of connections from a client?
• 10.23 I'm trying to deny foo.com, but it's not working.
• 10.24 I want to customize, or make my own error messages.

11. Troubleshooting

• 11.1 Why am I getting ``Proxy Access Denied?''
• 11.2 I can't get local_domain to work; Squid is caching the objects from my local servers.
• 11.3 I get Connection Refused when the cache tries to retrieve an object located on a sibling, even though the sibling thinks it delivered the object to my cache.
• 11.4 Running out of filedescriptors
• 11.5 What are these strange lines about removing objects?
• 11.6 Can I change a Windows NT FTP server to list directories in Unix format?
• 11.7 Why am I getting ``Ignoring MISS from non-peer x.x.x.x?''
• 11.8 DNS lookups for domain names with underscores (_) always fail.
• 11.9 Why does Squid say: ``Illegal character in hostname; underscores are not allowed?'
• 11.10 Why am I getting access denied from a sibling cache?
• 11.11 Cannot bind socket FD NN to *:8080 (125) Address already in use
• 11.12 icpDetectClientClose: ERROR xxx.xxx.xxx.xxx: (32) Broken pipe
• 11.13 icpDetectClientClose: FD 135, 255 unexpected bytes
• 11.14 Does Squid work with NTLM Authentication?
• 11.15 The default parent option isn't working!
• 11.16 ``Hot Mail'' complains about: Intrusion Logged. Access denied.
• 11.17 My Squid becomes very slow after it has been running for some time.
• 11.18 WARNING: Failed to start 'dnsserver'
• 11.19 Sending in Squid bug reports
• 11.20 Debugging Squid
• 11.21 FATAL: ipcache_init: DNS name lookup tests failed
• 11.22 FATAL: Failed to make swap directory /var/spool/cache: (13) Permission denied
• 11.23 FATAL: Cannot open HTTP Port
• 11.24 FATAL: All redirectors have exited!
• 11.25 FATAL: file_map_allocate: Exceeded filemap limit
• 11.26 FATAL: You've run out of swap file numbers.
• 11.27 I am using up over 95% of the filemap bits?!!
• 11.28 FATAL: Cannot open /usr/local/squid/logs/access.log: (13) Permission denied
• 11.29 When using a username and password, I can not access some files.
• 11.30 pingerOpen: icmp_sock: (13) Permission denied
• 11.31 What is a forwarding loop?
• 11.32 accept failure: (71) Protocol error
• 11.33 storeSwapInFileOpened: ... Size mismatch
• 11.34 Why do I get fwdDispatch: Cannot retrieve 'https://www.buy.com/corp/ordertracking.asp'
• 11.35 Squid can't access URLs like http://3626046468/ab2/cybercards/moreinfo.html
• 11.36 I get a lot of ``URI has whitespace'' error messages in my cache log, what should I do?
• 11.37 commBind: Cannot bind socket FD 5 to 127.0.0.1:0: (49) Can't assign requested address
• 11.38 Unknown cache_dir type '/var/squid/cache'
• 11.39 unrecognized: 'cache_dns_program /usr/local/squid/bin/dnsserver'
• 11.40 Is dns_defnames broken in 2.3.STABLE1 and STABLE2?
• 11.41 What does sslReadClient: FD 14: read failure: (104) Connection reset by peer mean?
• 11.42 What does Connection refused mean?
• 11.43 squid: ERROR: no running copy
• 11.44 FATAL: getgrnam failed to find groupid for effective group 'nogroup'
• 11.45 ``Unsupported Request Method and Protocol'' for https URLs.
• 11.46 Squid uses 100% CPU
• 11.47 Webmin's cachemgr.cgi crashes the operating system
• 11.48 Segment Violation at startup or upon first request
• 11.49 urlParse: Illegal character in hostname 'proxy.mydomain.com:8080proxy.mydomain.com'
• 11.50 Requests for international domain names does not work
• 11.51 Why do I sometimes get ``Zero Sized Reply''?

12. How does Squid work?

• 12.1 What are cachable objects?
• 12.2 What is the ICP protocol?
• 12.3 What is the dnsserver?
• 12.4 What is the ftpget program for?
• 12.5 FTP PUT's don't work!
• 12.6 What is a cache hierarchy? What are parents and siblings?
• 12.7 What is the Squid cache resolution algorithm?
• 12.8 What features are Squid developers currently working on?
• 12.9 Tell me more about Internet traffic workloads
• 12.10 What are the tradeoffs of caching with the NLANR cache system?
• 12.11 Where can I find out more about firewalls?
• 12.12 What is the ``Storage LRU Expiration Age?''
• 12.13 What is ``Failure Ratio at 1.01; Going into hit-only-mode for 5 minutes''?
• 12.14 Does squid periodically re-read its configuration file?
• 12.15 How does unlinkd work?
• 12.16 What is an icon URL?
• 12.17 Can I make my regular FTP clients use a Squid cache?
• 12.18 Why is the select loop average time so high?
• 12.19 How does Squid deal with Cookies?
• 12.20 How does Squid decide when to refresh a cached object?
• 12.21 What exactly is a deferred read?
• 12.22 Why is my cache's inbound traffic equal to the outbound traffic?
• 12.23 How come some objects do not get cached?
• 12.24 What does keep-alive ratio mean?
• 12.25 How does Squid's cache replacement algorithm work?
• 12.26 What are private and public keys?
• 12.27 What is FORW_VIA_DB for?
• 12.28 Does Squid send packets to port 7 (echo)? If so, why?
• 12.29 What does ``WARNING: Reply from unknown nameserver [a.b.c.d]'' mean?
• 12.30 How does Squid distribute cache files among the available directories?
• 12.31 Why do I see negative byte hit ratio?
• 12.32 What does ``Disabling use of private keys'' mean?
• 12.33 What is a half-closed filedescriptor?
• 12.34 What does --enable-heap-replacement do?
• 12.35 Why is actual filesystem space used greater than what Squid thinks?
• 12.36 How do positive_dns_ttl and negative_dns_ttl work?
• 12.37 What does swapin MD5 mismatch mean?
• 12.38 What does failed to unpack swapfile meta data mean?
• 12.39 Why doesn't Squid make ident lookups in interception mode?
• 12.40 dnsSubmit: queue overload, rejecting blah
• 12.41 What are FTP passive connections?

13. Multicast

• 13.1 What is Multicast?
• 13.2 How do I know if I'm on the Mbone?
• 13.3 Should I be using Multicast ICP?
• 13.4 How do I configure Squid to send Multicast ICP queries?
• 13.5 How do I know what Multicast TTL to use?
• 13.6 How do I configure Squid to receive and respond to Multicast ICP?

14. System-Dependent Weirdnesses

• 14.1 Solaris
• 14.2 FreeBSD
• 14.3 OSF1/3.2
• 14.4 BSD/OS
• 14.5 Linux
• 14.6 HP-UX
• 14.7 IRIX
• 14.8 SCO-UNIX

15. Redirectors

• 15.1 What is a redirector?
• 15.2 Why use a redirector?
• 15.3 How does it work?
• 15.4 Can I use the redirector to return HTTP redirect messages?
• 15.5 FATAL: All redirectors have exited!
• 15.6 Redirector interface is broken re IDENT values

16. Cache Digests

• 16.1 What is a Cache Digest?
• 16.2 How and why are they used?
• 16.3 What is the theory behind Cache Digests?
• 16.4 How is the size of the Cache Digest in Squid determined?
• 16.5 What hash functions (and how many of them) does Squid use?
• 16.6 How are objects added to the Cache Digest in Squid?
• 16.7 Does Squid support deletions in Cache Digests? What are diffs/deltas?
• 16.8 When and how often is the local digest built?
• 16.9 How are Cache Digests transferred between peers?
• 16.10 How and where are Cache Digests stored?
• 16.11 How are the Cache Digest statistics in the Cache Manager to be interpreted?
• 16.12 What are False Hits and how should they be handled?
• 16.13 How can Cache Digest related activity be traced/debugged?
• 16.14 What about ICP?
• 16.15 Is there a Cache Digest Specification?
• 16.16 Would it be possible to stagger the timings when cache_digests are retrieved from peers?

17. Interception Caching/Proxying

• 17.1 Interception caching for Solaris, SunOS, and BSD systems
• 17.2 Interception caching with Linux 2.0 and ipfwadm
• 17.3 Interception caching with Linux 2.2 and ipchains
• 17.4 Interception caching with Linux 2.4 and netfilter
• 17.5 Interception caching with Cisco routers
• 17.6 Interception caching with LINUX 2.0.29 and CISCO IOS 11.1
• 17.7 The cache is trying to connect to itself...
• 17.8 Interception caching with FreeBSD
• 17.9 Interception caching with ACC Tigris digital access server
• 17.10 ``Connection reset by peer'' and Cisco policy routing
• 17.11 WCCP - Web Cache Coordination Protocol
• 17.12 Can someone tell me what version of cisco IOS WCCP is added in?
• 17.13 What about WCCPv2?
• 17.14 Interception caching with Foundry L4 switches
• 17.15 Can I use proxy_auth with interception?

18. SNMP

• 18.1 Does Squid support SNMP?
• 18.2 Enabling SNMP in Squid
• 18.3 Configuring Squid 2.2
• 18.4 Configuring Squid 2.1
• 18.5 How can I query the Squid SNMP Agent
• 18.6 What can I use SNMP and Squid for?
• 18.7 How can I use SNMP with Squid?
• 18.8 Where can I get more information/discussion about Squid and SNMP?

19. Squid version 2

• 19.1 What are the new features?
• 19.2 How do I configure 'ssl_proxy' now?
• 19.3 Logfile rotation doesn't work with Async I/O
• 19.4 Adding a new cache disk
• 19.5 Squid 2 performs badly on Linux
• 19.6 How do I configure proxy authentication with Squid-2?
• 19.7 Why does proxy-auth reject all users with Squid-2.2?
• 19.8 Delay Pools
• 19.9 Can I preserve my cache when upgrading from 1.1 to 2?
• 19.10 Customizable Error Messages
• 19.11 My squid.conf from version 1.1 doesn't work!

20. httpd-accelerator mode

• 20.1 What is the httpd-accelerator mode?
• 20.2 How do I set it up?
• 20.3 When using an httpd-accelerator, the port number for redirects is wrong

21. Related Software

• 21.1 Clients
• 21.2 Logfile Analysis
• 21.3 Configuration Tools
• 21.4 Squid add-ons
• 21.5 Ident Servers

22. DISKD

• 22.1 What is DISKD?
• 22.2 Does it perform better?
• 22.3 How do I use it?
• 22.4 FATAL: Unknown cache_dir type 'diskd'
• 22.5 If I use DISKD, do I have to wipe out my current cache?
• 22.6 How do I configure message queues?
• 22.7 How do I configure shared memory?
• 22.8 Sometimes shared memory and message queues aren't released when Squid exits.
• 22.9 What are the Q1 and Q2 parameters?

23. Authentication

• 23.1 How does Proxy Authentication work in Squid?
• 23.2 How do I use authentication in access controls?
• 23.3 Does Squid cache authentication lookups?
• 23.4 Are passwords stored in clear text or encrypted?

24. Terms and Definitions

• 24.1 Neighbor
• 24.2 Regular Expression

25. Security Concerns

• 25.1 Open-access proxies
• 25.2 Mail relaying