| View previous topic :: View next topic |
| Author |
Message |
jho
Apprentice
Joined: 24 May 2007
Posts: 153
Location: Jyväskylä, Finland
|
 Posted: Wed Nov 28, 2007 6:15 pm Post subject: Strange connections from 127.0.0.1 on apache logs |
 |
|
Hello,
This problem's been bugging me for a long time now.. I'm getting a lot of HTTP GETs like this:
| Code: | 127.0.0.1 - - [28/Nov/2007:19:25:55 +0200] "GET / HTTP/1.0" 200 1056
127.0.0.1 - - [28/Nov/2007:19:25:58 +0200] "GET / HTTP/1.0" 200 1056
127.0.0.1 - - [28/Nov/2007:19:25:59 +0200] "GET / HTTP/1.0" 200 1056
127.0.0.1 - - [28/Nov/2007:19:26:04 +0200] "GET / HTTP/1.0" 200 1056
127.0.0.1 - - [28/Nov/2007:19:26:05 +0200] "GET / HTTP/1.0" 200 1056
127.0.0.1 - - [28/Nov/2007:19:26:06 +0200] "GET / HTTP/1.0" 200 1056
127.0.0.1 - - [28/Nov/2007:19:26:08 +0200] "GET / HTTP/1.0" 200 1056
127.0.0.1 - - [28/Nov/2007:19:26:09 +0200] "GET / HTTP/1.0" 200 1056
127.0.0.1 - - [28/Nov/2007:19:26:10 +0200] "GET / HTTP/1.0" 200 1056
|
even though (as far as I know) I'm not doing any HTTP GETs on my own server. From what I've seen, the last number varies between 1054-1056. The request is always successful (200) though.
The requests seem to be related with some way to the other users' HTTP GETs on my server. When I have a lot of traffic, I also see lots of these.
They seem to appear any time from 10-80 seconds after the original request has been made.
Edit: Forgot to mention, they don't always pop up when I get an external HTTP GET. Around an hour ago I got them on every request, now I haven't seen any on the last hour, even though I'm getting as many requests as back then. 
From what I've found googling, a person had the same problem (well, not exactly. all the requests were invalid, status 400), which was the fault of the php script that generated some images he was using.
I'm not using php on my server, but am using cgi (perl) a lot. My scripts aren't generating any images, though.
I don't think there's anything that would cause those requests, so I'm asking the gurus for help here.
Here's the basic layout of my scripts, in case it helps (i'd rather not share the source, it's quite a mess and has a lot of things i'd need to remove if i'd post it) :
index.cgi:
| Code: |
1) sort files from a directory to an array
2) unshift a new value to be the first one on array
3) get CGI->new->param() if available
4a) if the param is bigger than $#array, param = $#array, if it's smaller than 0, param = 0
4b) check if the $ENV{REMOTE_ADDR} has voted already for that entry from ./voted/(name of the cgi->new->param id)
5a) check if the cgi->new->param is 0 or $#array
5b) if it is, disable certaion operations (like going to next entry on the last one)
6a) print the form with radio buttons and hidden field to identify the current entry to vote (handler "vote.cgi") unless the $ENV{REMOTE_ADDR} has already voted
6b) if it has, print options to navigate the entries
7a) open the file containing the votes, sum them up and divide by the amount of the entries, close the file
7b) print the average vote value unless there were no votes
|
vote.cgi
| Code: |
1) Die unless referer is index.cgi
2a) Open the voted list to see if the user has already voted
2b) If true, die
3a) check that the id and vote values are correct, die if not
3b) insert the $ENV{REMOTE_ADDR} to voted list
3c) insert the vote to votes list
4) print the same as index.cgi, but without checking for voted. Just print the navigation (which points to index.cgi)
|
The requests come after loading one of these. I don't see anything that should normally cause these requests. Do you?
TIA,
Cene |
|
| Back to top |
|
 |
hanj
Veteran
Joined: 19 Aug 2003
Posts: 1490
|
| Posted: Wed Nov 28, 2007 10:47 pm Post subject: |
|
|
Are you using cacti or mrtg to monitor system heath? Could this be server-status or mon connections?
hanji
_________________
Server Admin Blog - Uno-Code.com |
|
| Back to top |
|
|
jho
Apprentice
Joined: 24 May 2007
Posts: 153
Location: Jyväskylä, Finland
|
| Posted: Thu Nov 29, 2007 6:16 am Post subject: |
|
|
| hanj wrote: | Are you using cacti or mrtg to monitor system heath? Could this be server-status or mon connections?
hanji |
I'm not using cacti or mrtg, although I am using Apache's mod_status. Could this be the cause? |
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
Networking & Security
