Havp (parent for squid) + Squid causing crazy internet speed test.

[Techneau]

Ok, hopefully I am not the only one that is having this problem. However, I have Havp + squid functioning together on my pfsense box.

Havp: Parent for Squid

Squid: transparent proxy

My internet connection bandwidth is 65Mbps (down) and 6Mbps (up).

I have noticed that in this type of configuration when I run a speed test from be hide the pfsense box my connection goes haywire. First the ping happens right away (normal) however, once the ping is done the speed test takes about 5 - 10 seconds before it starts returning some information about my bandwidth. When it does start, the connection jumps from 0 to ranges way above my advertise range  :o (90Mbps - 165Mbps). All that would be fine if the results ended that way :-\ . When the speed test is over the download speed ends up lower than what I should be getting (15Mbps - 30Mbps) however, the upload seems to stay about right (roughly). All that changes when I change Havp from "parent of squid" to "transparent" . My speed test starts instantly and my results starts to read as it should. However, while Havp is in "transparent" it will not scan or detect viruses. Also the system log states that squid is already in "transparent" mode please change Havp to "standard" what gives?

I have been beating myself up trying to figure this out. Any ideas?

Thanks in advance for the help and input.


[doktornotor]

Uhm… so, use a different speed test that handles proxies properly?

[Techneau]

@doktornotor:

Uhm… so, use a different speed test that handles proxies properly?

Are you asking me if I used a speed test that handles proxies? (is there such a thing?)

No, I did not. I was wondering if this is because my data is flowing through the proxy. So is this normal? I've been in IT for about 7 years and haven't really played with much proxies (that I've configured).

However, if this is normal why was I able to hit the advertised bandwidth with Havp set to transparent?

Thanks for your reply.

[doktornotor]

@Neau:

I was wondering if this is because my data is flowing through the proxy. So is this normal? I've been in IT for about 7 years and haven't really played with much proxies (that I've configured).

Obviously, if you are downloading proxy cached data, you won't get any meaningful results.

Instead of using some flash/java-based gimmicks, why don't you download some Linux distribution ISO or whatever to get some realistic figures?

On the HAVP think - IIRC it uses "trickling", i.e, download a part of the file, scan, download another part, etc. It's been a couple of years ago I last touched it; proved to be a complete resource/performance and download speed hog, would never touch the thing again.

[johnnybe]

@doktornotor:

On the HAVP think - IIRC it uses "trickling", i.e, download a part of the file, scan, download another part, etc. It's been a couple of years ago I last touched it; proved to be a complete resource/performance and download speed hog, would never touch the thing again.

I agree. Apart from that, the detection level is very poor and still have the fact that it presents many false positives. Short story: headache.

[Techneau]

Great thanks for the information. That gives me the will to move on to something else :D.

I have a quick unrelated question… So far the only way to delete files in the pfsense directory (cache logs, or like the ones in the image ,etc ) is to use SSH. Is this correct?

Thanks again for the help.