You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by "i.t" <i....@ithum.de> on 2003/01/27 20:13:50 UTC
[users@httpd] 501 - new script kiddie activity
request header with control chars looks like
193.144.78.177 - - [27/Jan/2003:20:00:01 +0100] "�" 501 - "-" "-"
217.5.85.153 - - [27/Jan/2003:20:00:09 +0100] "�" 501 - "-" "-"
217.81.181.63 - - [27/Jan/2003:20:00:10 +0100] "�" 501 - "-" "-"
80.146.135.29 - - [27/Jan/2003:20:00:25 +0100] "�" 501 - "-" "-"
and corresponding entries in the error_log
[Mon Jan 27 20:07:58 2003] [error] [client 217.231.252.164] Invalid method in
request �
[Mon Jan 27 20:08:07 2003] [error] [client 80.144.163.42] Invalid method in
request �
doing a
grep 501 access_log |wc -l
344
grep 501 access_log |cut -f 1 -d "-" |sort -u|wc -l
60
until yet :-
shouldn't be a problem;
server-status shows a few long R
but
CPU Usage: u.36 s.32 cu0 cs0 - .000151% CPU load
.00124 requests/sec - 1 B/second - 1140 B/request
critical performance load would be about 1000 rps on this apache server...
--
. ___
| | Irmund Thum
| |
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] 501 - new script kiddie activity
Posted by "i.t" <i....@ithum.de>.
msg Montag 27 Januar 2003 21:17 by Amol Jakatdar:
> Your HTTPS requests seem to be going to HTTP virtual host. SSL virtual
> host configuration problem...
no -
the ssl logs are clear;
some actual results:
grep 501 access_log |wc -l
908
grep 501 access_log |cut -f 1 -d "-" |sort -u|wc -l
98
the 98 unique IP addresses are mostly in the 217 and 80 ranges, e.g.
80.128.143.159
80.128.18.231
80.128.230.117
217.84.153.192
217.84.189.53
217.84.37.75
> i.t wrote:
> > request header with control chars looks like
> >
> > 193.144.78.177 - - [27/Jan/2003:20:00:01 +0100] "�" 501 - "-" "-"
> > 217.5.85.153 - - [27/Jan/2003:20:00:09 +0100] "�" 501 - "-" "-"
> > 217.81.181.63 - - [27/Jan/2003:20:00:10 +0100] "�" 501 - "-" "-"
> > 80.146.135.29 - - [27/Jan/2003:20:00:25 +0100] "�" 501 - "-" "-"
> >
> > and corresponding entries in the error_log
> > [Mon Jan 27 20:07:58 2003] [error] [client 217.231.252.164] Invalid
> > method in request �
> > [Mon Jan 27 20:08:07 2003] [error] [client 80.144.163.42] Invalid method
> > in request �
> >
> > doing a
> > grep 501 access_log |wc -l
> > 344
> > grep 501 access_log |cut -f 1 -d "-" |sort -u|wc -l
> > 60
> >
> > until yet :-
> > shouldn't be a problem;
> > server-status shows a few long R
> > but
> > CPU Usage: u.36 s.32 cu0 cs0 - .000151% CPU load
> > .00124 requests/sec - 1 B/second - 1140 B/request
--
. ___
| |
| |
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] 501 - new script kiddie activity
Posted by Amol Jakatdar <aj...@odu.edu>.
Your HTTPS requests seem to be going to HTTP virtual host. SSL virtual
host configuration problem...
i.t wrote:
> request header with control chars looks like
>
> 193.144.78.177 - - [27/Jan/2003:20:00:01 +0100] "�" 501 - "-" "-"
> 217.5.85.153 - - [27/Jan/2003:20:00:09 +0100] "�" 501 - "-" "-"
> 217.81.181.63 - - [27/Jan/2003:20:00:10 +0100] "�" 501 - "-" "-"
> 80.146.135.29 - - [27/Jan/2003:20:00:25 +0100] "�" 501 - "-" "-"
>
> and corresponding entries in the error_log
> [Mon Jan 27 20:07:58 2003] [error] [client 217.231.252.164] Invalid method in
> request �
> [Mon Jan 27 20:08:07 2003] [error] [client 80.144.163.42] Invalid method in
> request �
>
> doing a
> grep 501 access_log |wc -l
> 344
> grep 501 access_log |cut -f 1 -d "-" |sort -u|wc -l
> 60
>
> until yet :-
> shouldn't be a problem;
> server-status shows a few long R
> but
> CPU Usage: u.36 s.32 cu0 cs0 - .000151% CPU load
> .00124 requests/sec - 1 B/second - 1140 B/request
>
> critical performance load would be about 1000 rps on this apache server...
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org