You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Chad Morland <cm...@gmail.com> on 2011/04/05 19:00:02 UTC
[users@httpd] Full Request URI in access_log
I've got a domain hosted on one of our servers that seems to be getting a
ton of junk traffic from Bit Torrent clients.
The request that is showing up in my access_log is:
/announce...cedc031275%20430?info_hash=%CE%0Az%19%3C%3B~%84%2F.%8Cc%8A%DDyZ%C7%18%18%26&peer_id=-BC0109-%5E%02%B2%FDw%AB%19%DD%D9%BDxB&port=24668&natmapped=1&localip=192.168.1.11&port_type=wan&uploaded=0&downloaded=0&left=31457280&numwant=100&compact=1&no_peer_id=1&key=48054&event=started
As you can see the full URI is not displayed after "announce". What is
causing this to be clipped? I've tried different LogFormat options but
nothing seems to display the full URI.
I am trying to build a firewall content rule to reject access to this URL
but I need to find out what the full request is.
Thoughts?
Re: [users@httpd] Full Request URI in access_log
Posted by Daniel Reinhardt <cr...@cryptodan.net>.
Why not just block the offending IP's ?
Sent from my Verizon Wireless BlackBerry
-----Original Message-----
From: Chad Morland <cm...@gmail.com>
Date: Tue, 5 Apr 2011 13:00:02
To: <us...@httpd.apache.org>
Reply-To: users@httpd.apache.org
Subject: [users@httpd] Full Request URI in access_log
I've got a domain hosted on one of our servers that seems to be getting a
ton of junk traffic from Bit Torrent clients.
The request that is showing up in my access_log is:
/announce...cedc031275%20430?info_hash=%CE%0Az%19%3C%3B~%84%2F.%8Cc%8A%DDyZ%C7%18%18%26&peer_id=-BC0109-%5E%02%B2%FDw%AB%19%DD%D9%BDxB&port=24668&natmapped=1&localip=192.168.1.11&port_type=wan&uploaded=0&downloaded=0&left=31457280&numwant=100&compact=1&no_peer_id=1&key=48054&event=started
As you can see the full URI is not displayed after "announce". What is
causing this to be clipped? I've tried different LogFormat options but
nothing seems to display the full URI.
I am trying to build a firewall content rule to reject access to this URL
but I need to find out what the full request is.
Thoughts?
Re: [users@httpd] Full Request URI in access_log
Posted by "Macks, Aaron" <am...@harvardbusiness.org>.
I've seen urls with .... in the middle coming from some BBS systems as referrers. it seems some of the software condenses the url in the display, but sets the link target to the full one. I think then users quote that post and the target gets confused into the http://foo...html url.
Maybe a bad crawler is picking up the ... urls also
A
On Apr 5, 2011, at 2:19 PM, Chad Morland wrote:
>
>
> On Tue, Apr 5, 2011 at 2:11 PM, Yehuda Katz <ye...@ymkatz.net> wrote:
> On Tue, Apr 5, 2011 at 1:00 PM, Chad Morland <cm...@gmail.com> wrote:
> I've got a domain hosted on one of our servers that seems to be getting a ton of junk traffic from Bit Torrent clients.
>
> The request that is showing up in my access_log is:
>
> /announce...cedc031275%20430?info_hash=%CE%0Az%19%3C%3B~%84%2F.%8Cc%8A%DDyZ%C7%18%18%26&peer_id=-BC0109-%5E%02%B2%FDw%AB%19%DD%D9%BDxB&port=24668&natmapped=1&localip=192.168.1.11&port_type=wan&uploaded=0&downloaded=0&left=31457280&numwant=100&compact=1&no_peer_id=1&key=48054&event=started
>
> As you can see the full URI is not displayed after "announce". What is causing this to be clipped? I've tried different LogFormat options but nothing seems to display the full URI.
>
> You might be able to use "%U" for the URL without the query string and separately "%q" for the query string only.
>
> - Y
>
> I tried %U previously and I just tried it with %q as well. It looks like I am just getting the query string with %q but I still get "/announce...93d3fda523" for %U.
>
> It's possible that this actually is the URL being requested. I've never seen apache condense log entries prevously so it may just be a screwy request. I guess I will try matching "/announce..." and see if it does block those requests.
>
> Thanks for your help.
>
>
> -CM
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Full Request URI in access_log
Posted by Chad Morland <cm...@gmail.com>.
On Tue, Apr 5, 2011 at 2:11 PM, Yehuda Katz <ye...@ymkatz.net> wrote:
> On Tue, Apr 5, 2011 at 1:00 PM, Chad Morland <cm...@gmail.com> wrote:
>
>> I've got a domain hosted on one of our servers that seems to be getting a
>> ton of junk traffic from Bit Torrent clients.
>>
>> The request that is showing up in my access_log is:
>>
>>
>> /announce...cedc031275%20430?info_hash=%CE%0Az%19%3C%3B~%84%2F.%8Cc%8A%DDyZ%C7%18%18%26&peer_id=-BC0109-%5E%02%B2%FDw%AB%19%DD%D9%BDxB&port=24668&natmapped=1&localip=192.168.1.11&port_type=wan&uploaded=0&downloaded=0&left=31457280&numwant=100&compact=1&no_peer_id=1&key=48054&event=started
>>
>> As you can see the full URI is not displayed after "announce". What is
>> causing this to be clipped? I've tried different LogFormat options but
>> nothing seems to display the full URI.
>>
>
> You might be able to use "%U" for the URL without the query string and
> separately "%q" for the query string only.
>
> - Y
>
I tried %U previously and I just tried it with %q as well. It looks like I
am just getting the query string with %q but I still get
"/announce...93d3fda523" for %U.
It's possible that this actually is the URL being requested. I've never seen
apache condense log entries prevously so it may just be a screwy request. I
guess I will try matching "/announce..." and see if it does block those
requests.
Thanks for your help.
-CM
Re: [users@httpd] Full Request URI in access_log
Posted by Yehuda Katz <ye...@ymkatz.net>.
On Tue, Apr 5, 2011 at 1:00 PM, Chad Morland <cm...@gmail.com> wrote:
> I've got a domain hosted on one of our servers that seems to be getting a
> ton of junk traffic from Bit Torrent clients.
>
> The request that is showing up in my access_log is:
>
>
> /announce...cedc031275%20430?info_hash=%CE%0Az%19%3C%3B~%84%2F.%8Cc%8A%DDyZ%C7%18%18%26&peer_id=-BC0109-%5E%02%B2%FDw%AB%19%DD%D9%BDxB&port=24668&natmapped=1&localip=192.168.1.11&port_type=wan&uploaded=0&downloaded=0&left=31457280&numwant=100&compact=1&no_peer_id=1&key=48054&event=started
>
> As you can see the full URI is not displayed after "announce". What is
> causing this to be clipped? I've tried different LogFormat options but
> nothing seems to display the full URI.
>
You might be able to use "%U" for the URL without the query string and
separately "%q" for the query string only.
- Y