Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Got an apache log entry that looks like this, actually I have a bunch of them spread out over time.

XXX.XXX.XXX.XXX - - [27/Apr/2012:14:39:52 -0500] "-" 408 - "-" "-"

It wasn't a GET or POST, the method was "-".

Anyone else seen requests like this? It wasn't from the penetration tester, but I have it from LOTS of other IPs from Apr of 2012 up until and including today.

We failed it with a 408, just wondering what someone might be trying and googling for minus sign does NOT work.

share|improve this question

3 Answers 3

up vote 5 down vote accepted

408 is Request Timeout. This means that the client connected but didn't actually send any data for a while, and the server gave up and dropped the connection with this error. This is also why nothing else was logged; no data was actually sent from the client.

Apache's default timeout in this case is 300 seconds (5 minutes); it is configurable, but this generally shouldn't need to be changed.

share|improve this answer
    
I had just assumed 408 was one of the permission errors, but since its timed out, that makes more sense. –  Mark0978 Feb 6 '13 at 1:47

It means that Apache doesn't know what the request method is. In this case it was caused by a timeout (i.e. the client never sent a request). It's also common with 400 Bad Request responses where the client sends an invalid request (such as trying to speak TLS to a non-TLS port and vice versa), or closes the TCP connection as soon as it is establised without sending anything (such as monitoring services performing a TCP connection check).

share|improve this answer

Could be caused by slowloris or similiar attacks. The idea is to open as many connection as possible as long as possible. Timeout is by default 300 seconds in Apache.

If you use a preforking server it's easy to reach MaxClients and make the website unaccessible. If the Apache is misconfigured lots of forked processing can cause excessive swapping and kill the machine or slowing it down to a crawl.

mpm_event or a good configured mpm_worker should be harder targets for slowloris. Other mitigations are reducing Timeout to a lower value. I guess it depends on your clients. You probably don't want to kill dail-up users with a time too low timeout. 5 minutes on the other hand is probably too much.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.