diff --git a/src/AccessLogEntry.h b/src/AccessLogEntry.h
index ec07698294f..c53e8a6f724 100644
--- a/src/AccessLogEntry.h
+++ b/src/AccessLogEntry.h
@@ -32,11 +32,45 @@
 #include "ssl/support.h"
 #endif
 
+#include <optional>
+
 /* forward decls */
 class HttpReply;
 class HttpRequest;
 class CustomLog;
 
+// TODO: move
+/// Accumulates timings of message IO events.
+class MessageTimer
+{
+public:
+    using Clock = std::chrono::system_clock;
+    using Time = Clock::time_point;
+
+    MessageTimer() = default;
+    explicit MessageTimer(const Time &s) : first(s), last(s) {}
+
+    /// sets firstTime (if uninitialized yet) and lastTime (always) to the current time
+    void update() {
+        last = Clock::now();
+        if (!first)
+            first = last;
+    }
+
+    /// removes firstTime and lastTime values
+    void reset() { *this = MessageTimer(); }
+
+    /// the time of the first IO for the message
+    auto firstTime() const { return first; }
+
+    /// the time of the last IO for the message
+    auto lastTime() const { return last; }
+
+private:
+    std::optional<Time> first;
+    std::optional<Time> last;
+};
+
 class AccessLogEntry: public CodeContext
 {
 
@@ -164,6 +198,11 @@ class AccessLogEntry: public CodeContext
         Security::CertPointer sslClientCert; ///< cert received from the client
 #endif
         AnyP::PortCfgPointer port;
+
+        MessageTimer requestReadTimer; ///< first/last IO when receiving request from the client
+        MessageTimer responseWriteTimer; ///< first/last IO when writing response to the client
+        MessageTimer requestWriteTimer; ///< first/last IO when writing request to the peer
+        MessageTimer responseReadTimer; ///< first/last IO when reading response from the peer
     } cache;
 
     /** \brief This subclass holds log info for various headers in raw format
diff --git a/src/FwdState.cc b/src/FwdState.cc
index 6b08d6fc62c..2f0db198d87 100644
--- a/src/FwdState.cc
+++ b/src/FwdState.cc
@@ -1063,6 +1063,9 @@ FwdState::successfullyConnectedToPeer(const Comm::ConnectionPointer &conn)
 
     NoteOutgoingConnectionSuccess(serverConnection()->getPeer());
 
+    if (al)
+        al->cache.requestWriteTimer.reset();
+
     dispatch();
 }
 
diff --git a/src/HttpControlMsg.cc b/src/HttpControlMsg.cc
index e3d68b2ec18..0dee02ae7a7 100644
--- a/src/HttpControlMsg.cc
+++ b/src/HttpControlMsg.cc
@@ -12,7 +12,7 @@
 #include "HttpControlMsg.h"
 
 void
-HttpControlMsgSink::doneWithControlMsg()
+HttpControlMsgSink::doneWithControlMsg(const bool)
 {
     if (cbControlMsgSent) {
         ScheduleCallHere(cbControlMsgSent);
@@ -28,7 +28,7 @@ HttpControlMsgSink::wroteControlMsg(const CommIoCbParams &params)
         return;
 
     if (params.flag == Comm::OK) {
-        doneWithControlMsg();
+        doneWithControlMsg(true);
         return;
     }
 
diff --git a/src/HttpControlMsg.h b/src/HttpControlMsg.h
index 5e6d9c01d54..3312e3f8b82 100644
--- a/src/HttpControlMsg.h
+++ b/src/HttpControlMsg.h
@@ -33,7 +33,8 @@ class HttpControlMsgSink: public virtual AsyncJob
     /// called to send the 1xx message and notify the Source
     virtual void sendControlMsg(HttpControlMsg msg) = 0;
 
-    virtual void doneWithControlMsg();
+    /// \param wasSent whether the message was written to the client
+    virtual void doneWithControlMsg(bool wasSent);
 
     /// callback to handle Comm::Write completion
     void wroteControlMsg(const CommIoCbParams &);
diff --git a/src/auth/basic/NIS/nis_support.h b/src/auth/basic/NIS/nis_support.h
index 01b9dbf5beb..9c30298419d 100644
--- a/src/auth/basic/NIS/nis_support.h
+++ b/src/auth/basic/NIS/nis_support.h
@@ -8,9 +8,6 @@
 #ifndef SQUID_SRC_AUTH_BASIC_NIS_NIS_SUPPORT_H
 #define SQUID_SRC_AUTH_BASIC_NIS_NIS_SUPPORT_H
 
-#ifndef SQUID_SRC_AUTH_BASIC_NIS_NIS_SUPPORT_H
-#define SQUID_SRC_AUTH_BASIC_NIS_NIS_SUPPORT_H
-
 extern char * get_nis_password(char *user, char *nisdomain, char *nismap);
 
 #endif /* SQUID_SRC_AUTH_BASIC_NIS_NIS_SUPPORT_H */
diff --git a/src/cf.data.pre b/src/cf.data.pre
index a7d047f8858..f686d79fad4 100644
--- a/src/cf.data.pre
+++ b/src/cf.data.pre
@@ -4868,6 +4868,93 @@ DOC_START
 			values may significantly understate or exaggerate actual times.
 			Do not use this measurement unless you know it works in your case.
 
+		The following x_time %codes produce approximate absolute time of event
+		x in <full seconds since epoch>.<fractional seconds> format. Squid
+		should remember these events when they happen, but various temporary
+		implementation deficiencies may result in information loss for
+		unsuccessful transactions. Using logged times for erroneous
+		transaction analysis requires understanding of these Squid-version
+		specific limitations and is not recommended.
+
+		For CONNECT tunnels, all bytes (and a successful connection closure
+		indication) received from the client and forwarded to the server are
+		considered to be a part of the CONNECT request, while all bytes (and a
+		successful connection closure indication) received from the server and
+		forwarded to the client are considered to be a part of the CONNECT
+		response.
+
+		A failed socket read(2) or write(2) call is normally not reflected in
+		these %codes. Such I/O failures usually result in transaction errors.
+
+		If Squid received (or sent) the entire message in one network I/O (or
+		equivalent), then the corresponding x_first_byte_time value will be
+		the same as x_last_byte_time value.
+
+		received_request_first_byte_time: Squid starts parsing an incoming
+			client HTTP or FTP request. For requests generated by Squid (e.g.,
+			to download missing intermediate certificates or to fake a CONNECT
+			request during SslBump operations), this time is the time of that
+			request generation.
+
+			In most cases, Squid receives the entire request header in one
+			network read(2), but it is possible that the header will not be
+			fully received (and parsed) until a later time. Thus, this %code
+			time does not always correspond to the time when Squid starts
+			evaluating (beyond basic parsing) and forwarding a request.
+
+			In most cases, a client does not send the next request on a
+			client-to-Squid connection until Squid responds to the previous
+			one, but it is possible that Squid reads bytes belonging to
+			multiple requests in one network read(2). Squid may also read
+			PROXY protocol or TLS messages before reading HTTP or FTP request
+			bytes. In such and similar cases, this %code value does not match
+			the last read(2) time because Squid has to spend time on handling
+			other read bytes first.
+
+			Currently, this time may not match %tS because %tS timestamps is
+			created when the entire request header has been parsed.
+
+			Client-to-Squid TCP connection acceptance and client-Squid TLS
+			handshake (if any) happen earlier. REQMOD adaptation of read bytes
+			(if any) happens later.
+
+		received_request_last_byte_time: The last time Squid received HTTP or
+			FTP bytes (or a successful connection closure indication)
+			associated with the current request.
+
+		sent_request_first_byte_time: Squid successfully sent the first HTTP
+			or FTP request byte (at least) to an origin server or cache_peer.
+
+			If Squid retries or re-forwards a failed request, then this %code
+			reflects the _last_ such attempt.
+
+			Any Squid-to-peer TCP connection establishment, CONNECT tunnel
+			establishment, and TLS handshake happen earlier. RESPMOD
+			adaptation happens later.
+
+		sent_request_last_byte_time: The last time Squid successfully sent
+			HTTP or FTP bytes associated with the current request. See
+			%sent_request_first_byte_time %code for more caveats.
+
+		received_response_first_byte_time: Squid successfully received the
+			first HTTP or FTP response byte from an origin server or
+			cache_peer.
+
+			If Squid retries or re-forwards a failed request, then this %code
+			reflects the response in the _last_ such attempt.
+
+		received_response_last_byte_time: The last time Squid received HTTP or
+			FTP bytes (or a successful connection closure indication)
+			associated with the current response. See
+			%received_response_first_byte_time %code for more caveats.
+
+		sent_response_first_byte_time: Squid successfully sent the first HTTP
+			or FTP response byte (at least) to the client.
+
+		sent_response_last_byte_time: The last time Squid successfully sent
+			HTTP or FTP bytes associated with the current response to the
+			client. See %sent_response_first_byte_time %code for more caveats.
+
 	Access Control related format codes:
 
 		et	Tag returned by external acl
diff --git a/src/client_side.cc b/src/client_side.cc
index b2db9e42ef0..9f51d9a639f 100644
--- a/src/client_side.cc
+++ b/src/client_side.cc
@@ -1026,6 +1026,8 @@ ConnStateData::afterClientWrite(size_t size)
     if (pipeline.empty())
         return;
 
+    currentWriter().al->cache.responseWriteTimer.update();
+
     auto ctx = pipeline.front();
     if (size) {
         statCounter.client_http.kbytes_out += size;
@@ -1936,6 +1938,13 @@ ConnStateData::clientParseRequests()
             assert(!preservingClientData_);
         }
 
+        // The "first byte" time of a (possibly pipelined) request is defined as
+        // the time we _start_ parsing its header. If requestFirstByteTime is
+        // set, then do nothing as we continue to parse a request header we
+        // started to parse earlier. Otherwise, remember the time we started.
+        if (!requestFirstByteTime)
+            requestFirstByteTime = MessageTimer::Clock::now();
+
         if (Http::StreamPointer context = parseOneRequest()) {
             debugs(33, 5, clientConnection << ": done parsing a request");
             extendLifetime();
@@ -3723,7 +3732,7 @@ ConnStateData::sendControlMsg(HttpControlMsg msg)
 
         if (!writeControlMsgAndCall(rep.getRaw(), call)) {
             // but still inform the caller (so it may resume its operation)
-            doneWithControlMsg();
+            doneWithControlMsg(false);
         }
         return;
     }
@@ -3733,9 +3742,11 @@ ConnStateData::sendControlMsg(HttpControlMsg msg)
 }
 
 void
-ConnStateData::doneWithControlMsg()
+ConnStateData::doneWithControlMsg(const bool wasSent)
 {
-    HttpControlMsgSink::doneWithControlMsg();
+    if (wasSent && HttpControlMsgSink::cbControlMsgSent)
+        currentWriter().al->cache.responseWriteTimer.update();
+    HttpControlMsgSink::doneWithControlMsg(wasSent);
 
     if (Http::StreamPointer deferredRequest = pipeline.front()) {
         debugs(33, 3, clientConnection << ": calling PushDeferredIfNeeded after control msg wrote");
@@ -3900,6 +3911,9 @@ ConnStateData::clientPinnedConnectionRead(const CommIoCbParams &io)
     if (io.flag == Comm::ERR_CLOSING)
         return; // close handler will clean up
 
+    // AccessLogEntry::CacheDetails::responseReadTimer is not updated here
+    // because idle connections do not have an associated transaction.
+
     Must(pinning.serverConnection == io.conn);
 
 #if USE_OPENSSL
diff --git a/src/client_side.h b/src/client_side.h
index 291b69c76f3..065ef7549b3 100644
--- a/src/client_side.h
+++ b/src/client_side.h
@@ -11,6 +11,7 @@
 #ifndef SQUID_SRC_CLIENT_SIDE_H
 #define SQUID_SRC_CLIENT_SIDE_H
 
+#include "AccessLogEntry.h"
 #include "acl/ChecklistFiller.h"
 #include "base/RunnersRegistry.h"
 #include "clientStreamForward.h"
@@ -95,7 +96,7 @@ class ConnStateData:
 
     /* HttpControlMsgSink API */
     void sendControlMsg(HttpControlMsg) override;
-    void doneWithControlMsg() override;
+    void doneWithControlMsg(bool) override;
 
     /// Traffic parsing
     bool clientParseRequests();
@@ -384,6 +385,10 @@ class ConnStateData:
     /// managers logging of the being-accepted TLS connection secrets
     Security::KeyLogger keyLogger;
 
+    /// The first time parseOneRequest() was called for the current request.
+    /// This member gets cleared when request headers are successfully parsed.
+    std::optional<MessageTimer::Time> requestFirstByteTime;
+
 protected:
     void startDechunkingRequest();
     void finishDechunkingRequest(bool withSuccess);
diff --git a/src/client_side_request.cc b/src/client_side_request.cc
index 3ee97d4bcc6..0d37c9c2e96 100644
--- a/src/client_side_request.cc
+++ b/src/client_side_request.cc
@@ -125,6 +125,25 @@ ClientRequestContext::ClientRequestContext(ClientHttpRequest *anHttp) :
 
 CBDATA_CLASS_INIT(ClientHttpRequest);
 
+/// computes effective ClientHttpRequest start time, purging ConnStateData cache
+static auto
+ExtractRequestStartTime(ConnStateData * const conn)
+{
+    if (conn) {
+        // TODO: Create ClientHttpRequest earlier, when we _start_ parsing, to
+        // avoid temporary storing info in ConnStateData (among other problems).
+        if (auto &requestFirstByteTime = conn->requestFirstByteTime) {
+            const auto result = *requestFirstByteTime;
+            requestFirstByteTime.reset();
+            return result;
+        }
+        // else this is a "fake" request not triggered by header parsing
+    }
+    // else this is an "internal" request not associated with ConnStateData
+
+    return MessageTimer::Clock::now();
+}
+
 ClientHttpRequest::ClientHttpRequest(ConnStateData * aConn) :
 #if USE_ADAPTATION
     AsyncJob("ClientHttpRequest"),
@@ -133,7 +152,12 @@ ClientHttpRequest::ClientHttpRequest(ConnStateData * aConn) :
     conn_(cbdataReference(aConn))
 {
     CodeContext::Reset(al);
+
+    // TODO: Adjust transaction start (%tS) definition and code to include
+    // header parsing, removing this field and using cache.requestReadTimer.
     al->cache.start_time = current_time;
+    al->cache.requestReadTimer = MessageTimer(ExtractRequestStartTime(aConn));
+
     if (aConn) {
         al->tcpClient = aConn->clientConnection;
         al->cache.port = aConn->port;
diff --git a/src/clients/Client.cc b/src/clients/Client.cc
index 63bd4c3afaa..5453343a1f7 100644
--- a/src/clients/Client.cc
+++ b/src/clients/Client.cc
@@ -394,6 +394,9 @@ Client::sentRequestBody(const CommIoCbParams &io)
         return;
     }
 
+    if (fwd->al)
+        fwd->al->cache.requestWriteTimer.update();
+
     if (EBIT_TEST(entry->flags, ENTRY_ABORTED)) {
         abortOnData("store entry aborted while sending request body");
         return;
diff --git a/src/clients/FtpClient.cc b/src/clients/FtpClient.cc
index 6f9d8fa7af9..f20a9e2bfc1 100644
--- a/src/clients/FtpClient.cc
+++ b/src/clients/FtpClient.cc
@@ -371,6 +371,9 @@ Ftp::Client::readControlReply(const CommIoCbParams &io)
     if (io.flag == Comm::ERR_CLOSING)
         return;
 
+    if (io.flag == Comm::OK && fwd->al)
+        fwd->al->cache.responseReadTimer.update();
+
     if (EBIT_TEST(entry->flags, ENTRY_ABORTED)) {
         if (abortOnData("entry aborted during control reply read"))
             return;
@@ -872,6 +875,9 @@ Ftp::Client::writeCommandCallback(const CommIoCbParams &io)
         /* failed closes ctrl.conn and frees ftpState */
         return;
     }
+
+    if (fwd->al)
+        fwd->al->cache.requestWriteTimer.update();
 }
 
 /// handler called by Comm when FTP control channel is closed unexpectedly
@@ -973,6 +979,9 @@ Ftp::Client::dataRead(const CommIoCbParams &io)
 
     assert(io.fd == data.conn->fd);
 
+    if (io.flag == Comm::OK && fwd->al)
+        fwd->al->cache.responseReadTimer.update();
+
     if (EBIT_TEST(entry->flags, ENTRY_ABORTED)) {
         abortOnData("entry aborted during dataRead");
         return;
diff --git a/src/format/ByteCode.h b/src/format/ByteCode.h
index 222f60d7ea8..32bf313b0b8 100644
--- a/src/format/ByteCode.h
+++ b/src/format/ByteCode.h
@@ -160,6 +160,14 @@ typedef enum {
     LFT_TIME_LOCALTIME,
     LFT_TIME_GMT,
     LFT_TIME_START, // the time the master transaction started
+    LFT_RECEIVED_REQUEST_FIRST_BYTE_TIME,
+    LFT_RECEIVED_REQUEST_LAST_BYTE_TIME,
+    LFT_SENT_REQUEST_FIRST_BYTE_TIME,
+    LFT_SENT_REQUEST_LAST_BYTE_TIME,
+    LFT_RECEIVED_RESPONSE_FIRST_BYTE_TIME,
+    LFT_RECEIVED_RESPONSE_LAST_BYTE_TIME,
+    LFT_SENT_RESPONSE_FIRST_BYTE_TIME,
+    LFT_SENT_RESPONSE_LAST_BYTE_TIME,
 
     /* processing time details */
     LFT_TIME_TO_HANDLE_REQUEST,
diff --git a/src/format/Format.cc b/src/format/Format.cc
index db070620f6f..5c41e107642 100644
--- a/src/format/Format.cc
+++ b/src/format/Format.cc
@@ -373,6 +373,18 @@ actualRequestHeader(const AccessLogEntry::Pointer &al)
     return al->request;
 }
 
+static void
+TimePointToTimeval(const std::optional<MessageTimer::Time> &time, timeval &outtv, int &doSec) {
+    if (!time)
+        return;
+    using namespace std::chrono_literals;
+    const auto duration = time->time_since_epoch();
+    outtv.tv_sec = std::chrono::duration_cast<std::chrono::seconds>(duration).count();
+    const auto totalUsec = std::chrono::duration_cast<std::chrono::microseconds>(duration);
+    outtv.tv_usec = (totalUsec % std::chrono::microseconds(1s)).count();
+    doSec = 1;
+}
+
 void
 Format::Format::assemble(MemBuf &mb, const AccessLogEntry::Pointer &al, int logSequenceNumber) const
 {
@@ -653,6 +665,37 @@ Format::Format::assemble(MemBuf &mb, const AccessLogEntry::Pointer &al, int logS
                 doMsec = 1;
             }
             break;
+        case LFT_RECEIVED_REQUEST_FIRST_BYTE_TIME:
+            TimePointToTimeval(al->cache.requestReadTimer.firstTime(), outtv, doSec);
+            break;
+
+        case LFT_RECEIVED_REQUEST_LAST_BYTE_TIME:
+            TimePointToTimeval(al->cache.requestReadTimer.lastTime(), outtv, doSec);
+            break;
+
+        case LFT_SENT_REQUEST_FIRST_BYTE_TIME:
+            TimePointToTimeval(al->cache.requestWriteTimer.firstTime(), outtv, doSec);
+            break;
+
+        case LFT_SENT_REQUEST_LAST_BYTE_TIME:
+            TimePointToTimeval(al->cache.requestWriteTimer.lastTime(), outtv, doSec);
+            break;
+
+        case LFT_RECEIVED_RESPONSE_FIRST_BYTE_TIME:
+            TimePointToTimeval(al->cache.responseReadTimer.firstTime(), outtv, doSec);
+            break;
+
+        case LFT_RECEIVED_RESPONSE_LAST_BYTE_TIME:
+            TimePointToTimeval(al->cache.responseReadTimer.lastTime(), outtv, doSec);
+            break;
+
+        case LFT_SENT_RESPONSE_FIRST_BYTE_TIME:
+            TimePointToTimeval(al->cache.responseWriteTimer.firstTime(), outtv, doSec);
+            break;
+
+        case LFT_SENT_RESPONSE_LAST_BYTE_TIME:
+            TimePointToTimeval(al->cache.responseWriteTimer.lastTime(), outtv, doSec);
+            break;
 
         case LFT_REQUEST_HEADER:
             if (const Http::Message *msg = actualRequestHeader(al)) {
diff --git a/src/format/Token.cc b/src/format/Token.cc
index 2a24c8a3e5c..8cd93723723 100644
--- a/src/format/Token.cc
+++ b/src/format/Token.cc
@@ -151,6 +151,14 @@ static TokenTableEntry TokenTableMisc[] = {
     TokenTableEntry("note", LFT_NOTE ),
     TokenTableEntry("credentials", LFT_CREDENTIALS),
     TokenTableEntry("master_xaction", LFT_MASTER_XACTION),
+    TokenTableEntry("received_request_first_byte_time", LFT_RECEIVED_REQUEST_FIRST_BYTE_TIME),
+    TokenTableEntry("received_request_last_byte_time", LFT_RECEIVED_REQUEST_LAST_BYTE_TIME),
+    TokenTableEntry("sent_request_first_byte_time", LFT_SENT_REQUEST_FIRST_BYTE_TIME),
+    TokenTableEntry("sent_request_last_byte_time", LFT_SENT_REQUEST_LAST_BYTE_TIME),
+    TokenTableEntry("received_response_first_byte_time", LFT_RECEIVED_RESPONSE_FIRST_BYTE_TIME),
+    TokenTableEntry("received_response_last_byte_time", LFT_RECEIVED_RESPONSE_LAST_BYTE_TIME),
+    TokenTableEntry("sent_response_first_byte_time", LFT_SENT_RESPONSE_FIRST_BYTE_TIME),
+    TokenTableEntry("sent_response_last_byte_time", LFT_SENT_RESPONSE_LAST_BYTE_TIME),
     /*
      * Legacy external_acl_type format tokens
      */
@@ -606,6 +614,14 @@ Format::Token::parse(const char *def, Quoting *quoting)
 #endif
     case LFT_TIME_START:
     case LFT_TIME_SUBSECOND:
+    case LFT_RECEIVED_REQUEST_FIRST_BYTE_TIME:
+    case LFT_RECEIVED_REQUEST_LAST_BYTE_TIME:
+    case LFT_SENT_REQUEST_FIRST_BYTE_TIME:
+    case LFT_SENT_REQUEST_LAST_BYTE_TIME:
+    case LFT_RECEIVED_RESPONSE_FIRST_BYTE_TIME:
+    case LFT_RECEIVED_RESPONSE_LAST_BYTE_TIME:
+    case LFT_SENT_RESPONSE_FIRST_BYTE_TIME:
+    case LFT_SENT_RESPONSE_LAST_BYTE_TIME:
         divisor = 1000;
 
         if (widthMax > 0) {
diff --git a/src/http.cc b/src/http.cc
index 497155c76c5..c6e5cd1bcb2 100644
--- a/src/http.cc
+++ b/src/http.cc
@@ -1263,6 +1263,9 @@ HttpStateData::readReply(const CommIoCbParams &io)
         ++ IOStats.Http.read_hist[bin];
 
         request->hier.notePeerRead();
+
+        if (fwd->al)
+            fwd->al->cache.responseReadTimer.update();
     }
 
         /* Continue to process previously read data */
@@ -1270,6 +1273,8 @@ HttpStateData::readReply(const CommIoCbParams &io)
 
     case Comm::ENDFILE: // close detected by 0-byte read
         eof = 1;
+        if (fwd->al)
+            fwd->al->cache.responseReadTimer.update();
 
         /* Continue to process previously read data */
         break;
@@ -1752,6 +1757,9 @@ HttpStateData::wroteLast(const CommIoCbParams &io)
         return;
     }
 
+    if (fwd->al)
+        fwd->al->cache.requestWriteTimer.update();
+
     sendComplete();
 }
 
diff --git a/src/servers/FtpServer.cc b/src/servers/FtpServer.cc
index 65d628cb42c..ef499d1ecf7 100644
--- a/src/servers/FtpServer.cc
+++ b/src/servers/FtpServer.cc
@@ -174,6 +174,9 @@ Ftp::Server::readUploadData(const CommIoCbParams &io)
     assert(Comm::IsConnOpen(dataConn));
     assert(io.conn->fd == dataConn->fd);
 
+    if (io.flag == Comm::OK)
+        currentReader().al->cache.requestReadTimer.update();
+
     if (io.flag == Comm::OK && bodyPipe != nullptr) {
         if (io.size > 0) {
             statCounter.client_http.kbytes_in += io.size;
@@ -420,6 +423,8 @@ Ftp::Server::acceptDataConnection(const CommAcceptCbParams &params)
         // Some FTP servers close control connection here, but it may make
         // things worse from DoS p.o.v. and no better from data stealing p.o.v.
     } else {
+        currentReader().al->cache.requestReadTimer.update();
+
         closeDataConnection();
         dataConn = params.conn;
         dataConn->leaveOrphanage();
@@ -996,6 +1001,7 @@ Ftp::Server::wroteReplyData(const CommIoCbParams &io)
 
     assert(pipeline.front()->http);
     pipeline.front()->http->out.size += io.size;
+    pipeline.front()->http->al->cache.responseWriteTimer.update();
     replyDataWritingCheckpoint();
 }
 
@@ -1246,6 +1252,7 @@ Ftp::Server::wroteEarlyReply(const CommIoCbParams &io)
     if (context != nullptr && context->http) {
         context->http->out.size += io.size;
         context->http->out.headers_sz += io.size;
+        context->http->al->cache.responseWriteTimer.update();
     }
 
     flags.readMore = true;
@@ -1268,6 +1275,7 @@ Ftp::Server::wroteReply(const CommIoCbParams &io)
     assert(context->http);
     context->http->out.size += io.size;
     context->http->out.headers_sz += io.size;
+    context->http->al->cache.responseWriteTimer.update();
 
     if (master->serverState == fssError) {
         debugs(33, 5, "closing on FTP server error");
@@ -1711,6 +1719,8 @@ Ftp::Server::connectedForData(const CommConnectCbParams &params)
         Must(context->http->storeEntry() != nullptr);
         // TODO: call closeDataConnection() to reset data conn processing?
     } else {
+        currentWriter().al->cache.responseWriteTimer.update();
+
         // Finalize the details and start owning the supplied connection.
         assert(params.conn);
         assert(dataConn);
diff --git a/src/servers/Server.cc b/src/servers/Server.cc
index 3c4004cf511..294538dd39b 100644
--- a/src/servers/Server.cc
+++ b/src/servers/Server.cc
@@ -9,6 +9,7 @@
 #include "squid.h"
 #include "anyp/PortCfg.h"
 #include "client_side.h"
+#include "client_side_request.h"
 #include "comm.h"
 #include "comm/Read.h"
 #include "debug/Stream.h"
@@ -56,6 +57,28 @@ Server::swanSong()
     BodyProducer::swanSong();
 }
 
+ClientHttpRequest &
+Server::currentReader()
+{
+    Assure(!pipeline.empty());
+    const auto readingTransaction = pipeline.back();
+    Assure(readingTransaction);
+    const auto http = readingTransaction->http;
+    Assure(http);
+    return *http;
+}
+
+ClientHttpRequest &
+Server::currentWriter()
+{
+    Assure(!pipeline.empty());
+    const auto writingTransaction = pipeline.front();
+    Assure(writingTransaction);
+    const auto http = writingTransaction->http;
+    Assure(http);
+    return *http;
+}
+
 void
 Server::stopReading()
 {
@@ -138,6 +161,11 @@ Server::doClientRead(const CommIoCbParams &io)
 
     case Comm::OK:
         statCounter.client_http.kbytes_in += rd.size;
+
+        if (!pipeline.empty())
+            currentReader().al->cache.requestReadTimer.update();
+        // else we start the timer after accumulating/parsing the request header
+
         if (!receivedFirstByte_)
             receivedFirstByte();
         // may comm_close or setReplyToError
@@ -150,6 +178,10 @@ Server::doClientRead(const CommIoCbParams &io)
     case Comm::ENDFILE: // close detected by 0-byte read
         debugs(33, 5, io.conn << " closed?");
 
+        if (!pipeline.empty())
+            currentReader().al->cache.requestReadTimer.update();
+        // else ignore this truncated/malformed request or an idle pconn closure
+
         if (shouldCloseOnEof()) {
             LogTagsErrors lte;
             lte.aborted = true;
diff --git a/src/servers/Server.h b/src/servers/Server.h
index 13bd67e1c5e..3e52e8a388e 100644
--- a/src/servers/Server.h
+++ b/src/servers/Server.h
@@ -119,6 +119,16 @@ class Server : virtual public AsyncJob, public BodyProducer
     /// abort any pending transactions and prevent new ones (by closing)
     virtual void terminateAll(const Error &, const LogTagsErrors &) = 0;
 
+    /// transaction allowed to read from the client-to-Squid connection
+    /// \prec !pipeline.empty()
+    /// \sa currentWriter()
+    ClientHttpRequest &currentReader();
+
+    /// transaction allowed to write to the client-to-Squid connection
+    /// \prec !pipeline.empty()
+    /// \sa currentReader()
+    ClientHttpRequest &currentWriter();
+
     void doClientRead(const CommIoCbParams &io);
     void clientWriteDone(const CommIoCbParams &io);
 
diff --git a/src/tunnel.cc b/src/tunnel.cc
index 0c01e34f224..82772cad9cd 100644
--- a/src/tunnel.cc
+++ b/src/tunnel.cc
@@ -594,6 +594,9 @@ TunnelStateData::readServer(char *, size_t len, Comm::Flag errcode, int xerrno)
     if (errcode == Comm::ERR_CLOSING)
         return;
 
+    if (errcode == Comm::OK)
+        al->cache.responseReadTimer.update();
+
     if (len > 0) {
         server.bytesIn(len);
         statCounter.server.all.kbytes_in += len;
@@ -638,6 +641,9 @@ TunnelStateData::readClient(char *, size_t len, Comm::Flag errcode, int xerrno)
     if (errcode == Comm::ERR_CLOSING)
         return;
 
+    if (errcode == Comm::OK)
+        al->cache.requestReadTimer.update();
+
     if (len > 0) {
         client.bytesIn(len);
         statCounter.client_http.kbytes_in += len;
@@ -729,6 +735,8 @@ TunnelStateData::writeServerDone(char *, size_t len, Comm::Flag flag, int xerrno
         return;
     }
 
+    al->cache.requestWriteTimer.update();
+
     /* EOF? */
     if (len == 0) {
         debugs(26, 4, "No read input. Closing server connection.");
@@ -822,6 +830,8 @@ TunnelStateData::writeClientDone(char *, size_t len, Comm::Flag flag, int xerrno
         return;
     }
 
+    al->cache.responseWriteTimer.update();
+
     /* EOF? */
     if (len == 0) {
         debugs(26, 4, "Closing client connection due to 0 byte read.");
diff --git a/src/whois.cc b/src/whois.cc
index 8f67337b914..eb49153dad4 100644
--- a/src/whois.cc
+++ b/src/whois.cc
@@ -47,9 +47,13 @@ static IOCB whoisReadReply;
 /* PUBLIC */
 
 static void
-whoisWriteComplete(const Comm::ConnectionPointer &, char *buf, size_t, Comm::Flag, int, void *)
+whoisWriteComplete(const Comm::ConnectionPointer &, char * const buf, size_t, const Comm::Flag flag, int, void * const data)
 {
     xfree(buf);
+
+    const auto w = static_cast<WhoisState*>(data);
+    if (flag == Comm::OK && w->fwd->al)
+        w->fwd->al->cache.responseWriteTimer.update();
 }
 
 void
@@ -119,6 +123,9 @@ WhoisState::readReply(const Comm::ConnectionPointer &conn, char *aBuffer, size_t
     debugs(75, 3, conn << " read " << aBufferLength << " bytes");
     debugs(75, 5, "{" << aBuffer << "}");
 
+    if (flag == Comm::OK && fwd->al)
+        fwd->al->cache.responseReadTimer.update();
+
     // TODO: Honor delay pools.
 
     // XXX: Update statCounter before bailing