Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a small linux box set up with Apache as a way to teach myself Apache. I've set up port forwarding on my router so it's accessible from the outside world, and I've gotten a few strange requests for pages that don't exist from an ip address in China.

Looking at my access_log shows that most of these return 404 errors, which I'm guessing is a good thing. However, there is one request that looks like this:

58.218.204.110 - - [25/Dec/2010:19:05:25 -600] "GET http://173.201.161.57/ HTTP/1.1" 200 3895

I'm curious what this request means... That ip address is unconnected to my server as far as I know, and visiting it simply tells me information about my uid. So, my questions are: How is it that this request is showing up in my access_log, why is it returning 200, and is this a bad thing (do I need to set up more security)?

share|improve this question
add comment

3 Answers

up vote 2 down vote accepted

The format of the GET request is a proxy request. If you have the proxy function of your web server enabled then it will fetch the remote page and return it to the requestor.

If you have the proxy function disabled then the request is altered internally and the default page is served exactly as if they had requested / instead.

share|improve this answer
    
This was quite helpful, thanks. Is there something in the apache documentation that explains this/what directive configures how my server can be used as a proxy? –  Wilduck Dec 26 '10 at 8:31
1  
add comment

They are using it as a proxy.. or trying to use it as a proxy

share|improve this answer
1  
Anyone who runs a service accessible to the public at large will run into this, people trying to take advantage of possible misconfigurations. If you had your Apache badly configured as an open proxy, the request would have been fufilled. Since you don't, all you get is a weird log entry. –  ultrasawblade Dec 26 '10 at 2:57
add comment

'200' is just a regular/successful return code.

What it means is that the person requesting the page has retrieved it properly and, in this case, was the root location of your web server [http://173.201.161.57/] - no other pages or addresses.

It's normal and you will see many of these once the website is up and running.. that's how analytics applications/reporting works.. and that's how they can plot on a user's visit or behaviour.

Hope this helps!

Cheers, Alex

share|improve this answer
    
I'm aware that 200 is a successful return code. As I said, that ip is not the location of my server, which prompted the question. Why did apache return 200 if the request was for something that does not exist on my server. Also, how would one make that request in the first place? –  Wilduck Dec 26 '10 at 8:29
    
You can do it to any webserver through telnet or nc, i.e. telnet http://www.example.invalid 80 and then manually entering enter, then GET HTTP://www.go-here.invalid/index.html HTTP/1.1 –  ultrasawblade Jan 6 '11 at 23:11
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.