Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I noticed lines like these in my apache log

[Fri Oct 15 21:09:43 2010] [error] [client] client sent 
HTTP/1.1 request without hostname (see RFC2616 section 14.23): 

Coming from the following IP addresses:

What does the error message mean and what are these people trying to do?

share|improve this question
up vote 3 down vote accepted

Just someone scanning you with DFind looking for vulnerabilities in common php software. You probaby have alot more 404's in your error log.

Put this in dfind.ban

cat /path/to/error.log | grep "/" | egrep -o '([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})' | awk '{print "iptables -I INPUT -s " $1 " -j DROP"}' | sort | uniq > dfind.ban

Make it executable and run it and you will ban everyone who scanned you with dfind.

You can also ban them directly by using:

iptables -I INPUT -d -p tcp --dport 80 -m string --to 70 --algo bm --string 'GET /' -j DROP

Replace with your webserver ip.


share|improve this answer

Being scanned for vulnerabilities is a part of webserver life. You can try to block them, but ultimately you're likely to be scanned by more infected PCs than you'll be able to keep ahead of.

It's better to be proactive:

  • Always keep your services patched!
  • Disable features in software you don't need.
  • Scan your server for vulnerabilities so you know about them before someone out there takes advantage of them.
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.