Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a logging script set up on my site so that whenever you go to the site, the script logs the time, user agent, IP address, referrer, and what page you went to. For some reason, as I was looking at my log, I found that there are several places in which all that is in the log is a time and IP address. No user agent and no requested page. No referrer either, but that is fairly normal. I checked the IP addresses and most are from weird places like Hong Kong. Any ideas on the cause of this, and should I be worried?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

It looks to me like somebody using telnet or another network tool to probe your web server.

From the sample you show it looks like somebody is doing something like:

   telnet yourhost 80

   GET / <ENTER>
   <ENTER>

or telnet yourhost 80

   GET / HTTP/1.0<ENTER>
   Host:<ENTER>

You will see you can reproduce the access log with those commands like I did:

127.0.0.1 - - [31/May/2011:22:37:35 -0500] "GET /" 200 177 "-" "-"
127.0.0.1 - - [31/May/2011:22:37:53 -0500] "GET / HTTP/1.0" 200 453 "-" "-"
127.0.0.1 - - [31/May/2011:22:38:35 -0500] "GET / HTTP/1.1" 200 484 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

I would check if I can reproduce it that way. And then search who is the owner of those IPs.

share|improve this answer
    
The sample is at img684.imageshack.us/img684/7028/unledmd.png –  AKPWebDesign May 27 '11 at 4:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.