In my log watch records there has been a steadily growing progression of these:
408 Request Timeout null: 694 Time(s)
On my webserver.
Here are some of what look like the contributing requests from the
/var/log/apache2/access.log access log:
ip - - date requestsfor"-"? httpcode bytes referrer useragent 22.214.171.124 - - [28/Jan/2013:17:49:47 -0500] "-" 408 0 "-" "-" 126.96.36.199 - - [28/Jan/2013:17:57:40 -0500] "-" 408 0 "-" "-" 188.8.131.52 - - [28/Jan/2013:18:00:21 -0500] "-" 408 0 "-" "-"
Normal access request examples of course have a lot more relevant info like this:
ip - - date request-for httpcode bytes referrer useragent 184.108.40.206 - - [28/Jan/2013:17:45:41 -0500] "GET /images/al/al-mb0608tn.jpg HTTP/1.1" 200 4085 "http://example.com/brands.php?F=S&BrandCode=AL" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"
See a larger sampling of my access log here (with a few normal get requests that 408 in with the rest)
I did reverse IP lookups on the ips, and they seem to come from diverse locations in the US and Canada. That could just mean that there is a proxy involved, I suppose? There is a large block from:
220.127.116.11 - - [18/Feb/2013:02:55:58 -0500] "-" 408 0 "-" "-"
That repeats frequently.
I hesitate to jump to conclusions that this is an attack as opposed to a fault, but the number of probes recorded has been steadily increasing at around the same time, e.g. logwatch also says
A total of 125 sites probed the server 18.104.22.168 22.214.171.124 126.96.36.199 188.8.131.52 184.108.40.206 220.127.116.11
.... on and on with a list of various ips that used detected probes against the server. There is some overlap of the ips listing as "probing" the server and the ips that hit the access log with nulls, so that may suggest an attack, but since the server has to serve requests, it'll be hard to tell a legit timeout from a DOS request timeout attack if that's what is going on here.
How do I debug this problem, or if it is an attack, deal with this attack?