Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I found some 408 errors on my httpd access log which contains no request and no referer:

2013-03-08 12:40:13 0 ::1 GET /some/page/4s.jpg HTTP/1.1 200 453 3872 4250 https://mydomain.com/some/other Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/533 (KHTML, like Gecko) Chrome/25 Safari/533
2013-03-08 12:40:34 0 ::1 - 408 501 - 165 - - TLSv1.1 DHE-RSA-CAMELLIA256-SHA

From the HTTP/1.1 status code definition, it says:

408 Request Timeout

The client did not produce a request within the time that the server was prepared to wait. The client MAY repeat the request without modifications at any later time.

I do not quite understand the first line. For example, a client connects successfully to the server for every request that was made (i.e. status 200 returned upon each request), then idle for a few minutes thereby not producing a request, would the server issue this 408 error? When does the server decides whether to wait for a request? Can somebody explain in detail what is happening at the TCP level that is causing this error to be triggered?

As requested, this is the TCP dump when it happens:

12:40:13.041634 IP6 (hlim 64, next-header TCP (6) payload length: 32) mydomain.com.https > mydomain.com.37471: Flags [.], cksum 0x0028 (incorrect -> 0xed9f), ack 1336570089, win 350, options [nop,nop,TS val 7864486 ecr 7864446], length 0
12:40:13.042618 IP6 (hlim 64, next-header TCP (6) payload length: 32) mydomain.com.37460 > mydomain.com.https: Flags [.], cksum 0x0028 (incorrect -> 0xbb99), ack 4287211002, win 1023, options [nop,nop,TS val 7864487 ecr 7864447], length 0
12:40:17.919329 IP6 (hlim 64, next-header TCP (6) payload length: 32) mydomain.com.https > mydomain.com.37458: Flags [F.], cksum 0x0028 (incorrect -> 0x1140), seq 2107993202, ack 2769234965, win 359, options [nop,nop,TS val 7869363 ecr 7864359], length 0
12:40:17.958619 IP6 (hlim 64, next-header TCP (6) payload length: 32) mydomain.com.37458 > mydomain.com.https: Flags [.], cksum 0x0028 (incorrect -> 0xfaf3), ack 2107993203, win 1023, options [nop,nop,TS val 7869403 ecr 7869363], length 0
12:40:18.003050 IP6 (hlim 64, next-header TCP (6) payload length: 32) mydomain.com.https > mydomain.com.37467: Flags [F.], cksum 0x0028 (incorrect -> 0x5822), seq 3856499507, ack 1089587623, win 359, options [nop,nop,TS val 7869447 ecr 7864442], length 0
12:40:18.003691 IP6 (hlim 64, next-header TCP (6) payload length: 32) mydomain.com.https > mydomain.com.37470: Flags [F.], cksum 0x0028 (incorrect -> 0x72b3), seq 3116585686, ack 16337793, win 359, options [nop,nop,TS val 7869448 ecr 7864443], length 0
12:40:18.003720 IP6 (hlim 64, next-header TCP (6) payload length: 32) mydomain.com.https > mydomain.com.37469: Flags [F.], cksum 0x0028 (incorrect -> 0x0aab), seq 2640249362, ack 130816480, win 359, options [nop,nop,TS val 7869448 ecr 7864443], length 0
12:40:18.003775 IP6 (hlim 64, next-header TCP (6) payload length: 32) mydomain.com.https > mydomain.com.37468: Flags [F.], cksum 0x0028 (incorrect -> 0x7d9d), seq 2416223137, ack 3816306445, win 359, options [nop,nop,TS val 7869448 ecr 7864443], length 0
12:40:18.008117 IP6 (hlim 64, next-header TCP (6) payload length: 32) mydomain.com.https > mydomain.com.37460: Flags [F.], cksum 0x0028 (incorrect -> 0xaa7a), seq 4287211002, ack 1965950539, win 400, options [nop,nop,TS val 7869452 ecr 7864487], length 0
12:40:18.042638 IP6 (hlim 64, next-header TCP (6) payload length: 32) mydomain.com.37467 > mydomain.com.https: Flags [.], cksum 0x0028 (incorrect -> 0x41d5), ack 3856499508, win 1023, options [nop,nop,TS val 7869487 ecr 7869447], length 0
12:40:18.043608 IP6 (hlim 64, next-header TCP (6) payload length: 32) mydomain.com.37469 > mydomain.com.https: Flags [.], cksum 0x0028 (incorrect -> 0xf45d), ack 2640249363, win 1023, options [nop,nop,TS val 7869488 ecr 7869448], length 0
12:40:18.043620 IP6 (hlim 64, next-header TCP (6) payload length: 32) mydomain.com.37470 > mydomain.com.https: Flags [.], cksum 0x0028 (incorrect -> 0x5c66), ack 3116585687, win 1023, options [nop,nop,TS val 7869488 ecr 7869448], length 0
12:40:18.043630 IP6 (hlim 64, next-header TCP (6) payload length: 32) mydomain.com.37468 > mydomain.com.https: Flags [.], cksum 0x0028 (incorrect -> 0x6750), ack 2416223138, win 1023, options [nop,nop,TS val 7869488 ecr 7869448], length 0
12:40:18.047630 IP6 (hlim 64, next-header TCP (6) payload length: 32) mydomain.com.37460 > mydomain.com.https: Flags [.], cksum 0x0028 (incorrect -> 0x947e), ack 4287211003, win 1023, options [nop,nop,TS val 7869492 ecr 7869452], length 0
12:40:22.001006 IP6 (hlim 64, next-header TCP (6) payload length: 32) mydomain.com.37467 > mydomain.com.https: Flags [F.], cksum 0x0028 (incorrect -> 0x325e), seq 1089587623, ack 3856499508, win 1023, options [nop,nop,TS val 7873445 ecr 7869447], length 0
12:40:22.001024 IP6 (hlim 64, next-header TCP (6) payload length: 32) mydomain.com.https > mydomain.com.37467: Flags [.], cksum 0x0028 (incorrect -> 0x2558), ack 1089587624, win 359, options [nop,nop,TS val 7873445 ecr 7873445], length 0
12:40:22.001221 IP6 (hlim 64, next-header TCP (6) payload length: 32) mydomain.com.37468 > mydomain.com.https: Flags [F.], cksum 0x0028 (incorrect -> 0x57da), seq 3816306445, ack 2416223138, win 1023, options [nop,nop,TS val 7873445 ecr 7869448], length 0
12:40:22.001231 IP6 (hlim 64, next-header TCP (6) payload length: 32) mydomain.com.https > mydomain.com.37468: Flags [.], cksum 0x0028 (incorrect -> 0x4ad5), ack 3816306446, win 359, options [nop,nop,TS val 7873445 ecr 7873445], length 0
12:40:22.001334 IP6 (hlim 64, next-header TCP (6) payload length: 32) mydomain.com.37469 > mydomain.com.https: Flags [F.], cksum 0x0028 (incorrect -> 0xe4e7), seq 130816480, ack 2640249363, win 1023, options [nop,nop,TS val 7873445 ecr 7869448], length 0
12:40:22.001343 IP6 (hlim 64, next-header TCP (6) payload length: 32) mydomain.com.https > mydomain.com.37469: Flags [.], cksum 0x0028 (incorrect -> 0xd7e2), ack 130816481, win 359, options [nop,nop,TS val 7873445 ecr 7873445], length 0
12:40:22.001452 IP6 (hlim 64, next-header TCP (6) payload length: 32) mydomain.com.37470 > mydomain.com.https: Flags [F.], cksum 0x0028 (incorrect -> 0x4cf0), seq 16337793, ack 3116585687, win 1023, options [nop,nop,TS val 7873445 ecr 7869448], length 0
12:40:22.001461 IP6 (hlim 64, next-header TCP (6) payload length: 32) mydomain.com.https > mydomain.com.37470: Flags [.], cksum 0x0028 (incorrect -> 0x3feb), ack 16337794, win 359, options [nop,nop,TS val 7873445 ecr 7873445], length 0
12:40:22.001586 IP6 (hlim 64, next-header TCP (6) payload length: 32) mydomain.com.37460 > mydomain.com.https: Flags [F.], cksum 0x0028 (incorrect -> 0x850c), seq 1965950539, ack 4287211003, win 1023, options [nop,nop,TS val 7873445 ecr 7869452], length 0
12:40:22.001599 IP6 (hlim 64, next-header TCP (6) payload length: 32) mydomain.com.https > mydomain.com.37460: Flags [.], cksum 0x0028 (incorrect -> 0x77e1), ack 1965950540, win 400, options [nop,nop,TS val 7873446 ecr 7873445], length 0
12:40:22.001728 IP6 (hlim 64, next-header TCP (6) payload length: 32) mydomain.com.37458 > mydomain.com.https: Flags [F.], cksum 0x0028 (incorrect -> 0xeb27), seq 2769234965, ack 2107993203, win 1023, options [nop,nop,TS val 7873446 ecr 7869363], length 0
12:40:22.001737 IP6 (hlim 64, next-header TCP (6) payload length: 32) mydomain.com.https > mydomain.com.37458: Flags [.], cksum 0x0028 (incorrect -> 0xddcc), ack 2769234966, win 359, options [nop,nop,TS val 7873446 ecr 7873446], length 0
12:40:34.013882 IP6 (hlim 64, next-header TCP (6) payload length: 32) mydomain.com.https > mydomain.com.37471: Flags [F.], cksum 0x0028 (incorrect -> 0x9bb2), seq 781845090, ack 1336570089, win 350, options [nop,nop,TS val 7885458 ecr 7864446], length 0
12:40:34.053632 IP6 (hlim 64, next-header TCP (6) payload length: 32) mydomain.com.37471 > mydomain.com.https: Flags [.], cksum 0x0028 (incorrect -> 0x4976), ack 781845091, win 350, options [nop,nop,TS val 7885498 ecr 7885458], length 0
12:40:36.088226 IP6 (hlim 64, next-header TCP (6) payload length: 40) mydomain.com.37474 > mydomain.com.https: Flags [S], cksum 0x0030 (incorrect -> 0x42d4), seq 1581978338, win 43690, options [mss 65476,sackOK,TS val 7887532 ecr 0,nop,wscale 7], length 0
12:40:36.088250 IP6 (hlim 64, next-header TCP (6) payload length: 40) mydomain.com.https > mydomain.com.37474: Flags [S.], cksum 0x0030 (incorrect -> 0x8f58), seq 3195443663, ack 1581978339, win 43690, options [mss 65476,sackOK,TS val 7887532 ecr 7887532,nop,wscale 7], length 0
12:40:36.088273 IP6 (hlim 64, next-header TCP (6) payload length: 32) mydomain.com.37474 > mydomain.com.https: Flags [.], cksum 0x0028 (incorrect -> 0x618a), ack 3195443664, win 342, options [nop,nop,TS val 7887532 ecr 7887532], length 0
12:40:36.088687 IP6 (hlim 64, next-header TCP (6) payload length: 427) mydomain.com.37474 > mydomain.com.https: Flags [P.], cksum 0x01b3 (incorrect -> 0x2823), seq 1581978339:1581978734, ack 3195443664, win 342, options [nop,nop,TS val 7887533 ecr 7887532], length 395
12:40:36.088717 IP6 (hlim 64, next-header TCP (6) payload length: 32) mydomain.com.https > mydomain.com.37474: Flags [.], cksum 0x0028 (incorrect -> 0x5ff5), ack 1581978734, win 350, options [nop,nop,TS val 7887533 ecr 7887533], length 0

No queries were made between the times 12:40:13 and 12:40:34.

share|improve this question
    
Only if you provide some tcpdumps. –  Michael Hampton Mar 8 '13 at 3:37
    
@MichaelHampton, I managed to capture the dump when it occurs as updated above. –  Question Overflow Mar 8 '13 at 4:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.