I'm assuming that squid keeps a list of internal ip:port that a request is made on and the matching external ip:port that the request is fulfilled with.

In the case of a long transfer, such as a file download, it would be nice to be able to see which internal ip:port is downloading the file.

I am able to see the traffic and get the external ip:port that squid is using easily with tcpdump or iptraf but I can't find a way to map this back to an internal ip:port.