Squid with LigthSqiud reporting

[KOM]

Are they even using the proxy at all? Lightsquid builds its reports based on the squid access.log file. Are you using transparent or explicit proxy? If transparent, check Services - Squid proxy server - General - Transparent Proxy Settings - Bypass Proxy for These Source IPs and see if there is anything there.

[Modesty]

@kom said in Squid with LigthSqiud reporting:

pass Proxy for These Source IP

Nothing there

[KOM]

Well, once you answer my question about which mode your proxy is running in and confirmation that the missing users are definitely using the proxy or not, I might be able to come up with other ideas.

[Modesty]

@kom
Thanks for helping me.

Transparent HTTP Proxy is enebled

SSL filtering disabled

I also experience that log dont change:

The Sum Bytes are the same now as for 5 h ago

[KOM]

If you look at the squid access.log yourself, do you see any entries from IP addresses that are supposed to be in the report but aren't?

[Modesty]

@kom
I have a static ip on 192.168.0.50 that is not showing in log (a online smart house controller).

DHCP range is from 192.168.0.100 -.200

I only find log entries from DHCP range, no ip's under .100

So i guess that range outide DHCP is not catched.

[KOM]

Which means they aren't using the proxy. Is it possible that those devices are using a different gateway? pfSense can only transparently capture traffic that passes through it.

[Modesty]

Thanks for answer KOM.

Static IP use the same gateway, and I have only one defined in System->Routing

My conclusion so far is that IP's outside DHCP range are not captured (and static IP must be outside DHCP range).

I think this is something that is not the intension for makers of Squid, so there must be an answer someware. The idea to monitor traffic and not messure static IP is not best practise :

Anybody who have a indea for next step in this riddle?

[Modesty]

And now its fun
I switched on a pc with static IP and guess....:

.16 ip is in log. and .16 is static

I have many static, this is the only one in 3 days...

Any new ideas?

[KOM]

Nope. Borked configuration maybe? I stopped using transparent years ago and switched to explicit + WPAD.

[Modesty]

Hi

In my LigthSquid logs I only get http:// entries:

Is this an expected behaviour, not logging all types of access, like https?

[KOM]

You won't get ANY https traffic in transparent mode unless you install a trusted cert on every single last client that will use your proxy.