Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

in my previous post I got something weird in Apache log. Again, I found something strange, but what freaks me out is the response code. It's not 501 anymore, but 200. What do you say? Should I enable the paranoid-mode? Here's the entry:

***.***.***.*** - - [02/Feb/2011:00:42:51 +0100] "=\xa29)\x84\x11\xd0O\xa7@\xbd\x8f\xc4G\x96T\xf4" 200 25564
share|improve this question
add comment

2 Answers 2

It wasn't a valid HTTP-request. You could get similar log entry doing something like telnet youserver 80 and then Entering 'HELLO'. I guess there's some index.php at the root of your server?

share|improve this answer
1  
That's right. There's an index.php in /. –  aL3xa Feb 2 '11 at 11:14
1  
So, it simply runs it as the default handler of the request. N0t4h4ck. ) –  poige Feb 2 '11 at 11:47
    
Well, the IP originates from Ukraine. That's odd. =/ –  aL3xa Feb 2 '11 at 19:19
    
It's not odd, it's Interneted too. –  poige Feb 3 '11 at 1:19
add comment

If memory serves 200 is a HTTP Status code for OK

http://en.wikipedia.org/wiki/List_of_HTTP_status_codes

From wikipedia

2xx Success

This class of status codes indicates the action requested by the client was received, understood, accepted and processed successfully.

200 OK Standard response for successful HTTP requests. The actual response will depend on the request method used. In a GET request, the response will contain an entity corresponding to the requested resource. In a POST request the response will contain an entity describing or containing the result of the action.

share|improve this answer
    
Yes, 200 = OK, but doesn't that mean that potentially malicious request is executed on my server? –  aL3xa Feb 2 '11 at 1:07
    
I would think that this appearing in the log could be a simple misformed packet... as they do happen i dont often read my log files as close as you seem to :) (good on you tho for keep such a close eye on it) as an answer on your last post said if it woudl be more than likely that if this was a hacker that found a hole you would of been hacked well before you saw the log file. - I will however look around and see what i can find for you :) –  Trozz Feb 2 '11 at 1:10
1  
have a look httpd.apache.org/docs/1.3/logs.html#common it appears to be common place for a 200 in the logs, ill have a look at my apache server once i have a chance tomorrow –  Trozz Feb 2 '11 at 1:12
    
I'll do that, thanx for info! –  aL3xa Feb 2 '11 at 1:31
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.