Why Squid Has a UDP Socket on an Unexpected Port

Distinguish Squid DNS and peer-cache UDP sockets from the TCP listener clients use as a forward proxy.

An unfamiliar UDP port owned by Squid is not automatically another public HTTP proxy. Clients use the configured TCP listener for ordinary HTTP proxy access; Squid also opens sockets for DNS and cache-peer communication.

To identify the extra socket, record:

  • Whether it is TCP or UDP, its bound address and any remote endpoint shown.
  • The effective listener, DNS, ICP and HTCP settings for that instance.
  • The network reachability required by the feature those settings enable.

Squid's UDP address reference explicitly covers DNS, ICP and HTCP modules. Their behavior cannot be inferred from http_port, and a high port number alone does not identify the feature.

Do not enter that UDP endpoint into an application's HTTP proxy field or open it to every client just because it appears in the socket listing. Conversely, blocking the DNS path Squid actually uses can break later destination resolution. Change the firewall rule for the identified function: a resolver query socket, cache-peer port and client listener have different jobs.

འབྲེལ་བའི་རྩོམ་ཡིག