Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I setted up a new dedicated server, but I'm noticing strange requests, shown on the page Main >> Server Status >> Apache Status, WHM

11-1    -   0/0/159 .   0.16    57  0   0.0 0.00    0.66    127.0.0.1   server.hostname.com OPTIONS * HTTP/1.0
12-1    -   0/0/63  .   0.00    59  0   0.0 0.00    0.20    127.0.0.1   server.hostname.com OPTIONS * HTTP/1.0
13-1    -   0/0/161 .   0.00    58  0   0.0 0.00    0.75    127.0.0.1   server.hostname.com OPTIONS * HTTP/1.0
14-1    -   0/0/94  .   0.00    137 0   0.0 0.00    0.50    127.0.0.1   server.hostname.com OPTIONS * HTTP/1.0
15-1    -   0/0/55  .   0.00    136 0   0.0 0.00    0.42    127.0.0.1   server.hostname.com OPTIONS * HTTP/1.0
16-1    -   0/0/71  .   0.00    135 0   0.0 0.00    0.34    127.0.0.1   server.hostname.com OPTIONS * HTTP/1.0
17-1    -   0/0/48  .   0.19    71  0   0.0 0.00    0.29    127.0.0.1   server.hostname.com OPTIONS * HTTP/1.0
18-1    18132   0/60/116    _   0.29    6   14  0.0 0.28    0.50    41.226.107.166  server.hostname.com NULL
19-1    17678   0/87/98 _   0.46    9   15  0.0 0.59    0.64    200.165.138.70  server.hostname.com NULL
20-1    18424   0/16/36 W   0.09    0   0   0.0 0.06    0.19    127.0.0.1   server.hostname.com GET /whm-server-status/ HTTP/1.0
21-1    -   0/0/78  .   0.71    408 0   0.0 0.00    0.35    127.0.0.1   server.hostname.com OPTIONS * HTTP/1.0
22-1    -   0/0/1   .   0.00    734 0   0.0 0.00    0.00    127.0.0.1   server.hostname.com OPTIONS * HTTP/1.0

I really have a big ammount of these kind of requests, and what I think that it's strange, are the ip's where they came from.

I know 127.0.0.1 is normal, but there are requests from several different ips, like from korea, united states, etc.

What this means? Should I worry?

share|improve this question
    
Can you post examples from your access log of the options requests coming from external IPs? –  mahnsc Oct 9 '11 at 14:47
add comment

1 Answer

http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html

The OPTIONS method represents a request for information about the communication options available on the request/response chain identified by the Request-URI. This method allows the client to determine the options and/or requirements associated with a resource, or the capabilities of a server, without implying a resource action or initiating a resource retrieval.

and

If the Request-URI is an asterisk (" * "), the OPTIONS request is intended to apply to the server in general rather than to a specific resource. Since a server's communication options typically depend on the resource, the " * " request is only useful as a "ping" or "no-op" type of method; it does nothing beyond allowing the client to test the capabilities of the server. For example, this can be used to test a proxy for HTTP/1.1 compliance (or lack thereof).

So yes, it can be used as preparation procedure before any attack, so you should watch your logs, but it isn't attack necessarily. This type of call is literally standard

better to use some type of LogWatch utility to alert you on non-standard requests

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.