Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Web server: Nginx.

Checking our log files, there are many log entries of connections that:

  • take 59-61 seconds
  • send an empty request (or at least none is logged)
  • result in a 408 response (request timed out)
  • do not contain any http_user_agent
  • originate from a limited number of IPs

We are monitoring average times to serve responses and this obviously inflates our statistics. Apart from that though, is this a problem? Any idea why it is occurring? Does it suggest that somebody is intentionally messing with us? What should we do?

share|improve this question
    
This looks like an intentional attack. They are connected to you and then not sending anything. You time out their request after 60 seconds. They may be trying to run you out of connection capacity. –  David Schwartz Jun 20 '12 at 1:58

2 Answers 2

I cause these sometimes when using my phone on the train. I go through a low-signal area or a tunnel at just the right time (in between the TCP handshake and the request being sent) and that's what happens.

Phone carriers often put all their customers behind NAT so lots of users can come from a small number of IP addresses.

Do some more analysis:

  • How many are you seeing?
  • Do they follow patterns such as 7am - 9am?
  • Do the IP address belong to phone carriers?
  • Do you get any other traffic from the same IP addresses?
  • What does it look like?

Depending on the answers to those questions, it might be benign or it might be deliberately malicious. Either way, lowering the timeout might be a good idea. Even on a phone, no one waits for 60 seconds before making the request again.

share|improve this answer

It could be a slowloris attack:

See: http://en.wikipedia.org/wiki/Slowloris and http://ha.ckers.org/slowloris/

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.