Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've investigated my Lighttpd access log and found some strange things listed below. I do not know if it's good or bad, but bearshare? I was never or these sites I use my Centos only for website hosting. Could you help me understand these logs? - [26/Sep/2009:12:41:37 +0200] "GET HTTP/1.0" 404 345 "-" "Mozilla/3.0 (compatible)" - [26/Sep/2009:20:13:53 +0200] "GET HTTP/1.1" 404 345 "" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" - [26/Sep/2009:20:44:12 +0200] "GET HTTP/1.1" 404 345 "" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" - - [27/Sep/2009:12:43:58 +0200] "CONNECT HTTP/1.0" 501 357 "-" "-" - [28/Sep/2009:00:28:09 +0200] "CONNECT HTTP/1.1" 501 357 "-" "-" - [28/Sep/2009:23:48:54 +0200] "GET HTTP/1.1" 404 345 "" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" - [28/Sep/2009:23:58:14 +0200] "CONNECT HTTP/1.1" 501 357 "-" "-" - [29/Sep/2009:10:25:59 +0200] "GET HTTP/1.1" 200 1953 "-" "Mozilla/5.0 (compatible; MSIE 5.01; Win2000)" - [29/Sep/2009:14:59:51 +0200] "CONNECT HTTP/1.1" 501 357 "-" "-" - [01/Oct/2009:01:30:56 +0200] "CONNECT HTTP/1.1" 501 357 "-" "-"
share|improve this question
up vote 2 down vote accepted

It would appear that someone is attempting to use your lighttpd server as a proxy server. This means that they connect to you and ask you to fetch a Web page or download a file on their behalf, and then transparently send it back to them. Common reasons for people to do this:

  • To work around corporate or government firewalls. For example, the host might not be able to connect to, but they can connect to you, and you can connect to If they can make your Web server proxy their connection, they can effectively still get to the site.
  • To obscure one's identity. As far as is concerned, you are the one connecting to them, not

As it happens, you are blocking most of them, as indicated by the 404 and 501 HTTP codes. However, the connection from to gave a 200 code, which indicates success. You should definitely check your lighttpd configuration and ensure that mod_proxy is restricted or disabled (unless you intended to offer free proxy services).

share|improve this answer
Thank you very much! – tomaszs Oct 2 '09 at 6:29
The problems is that i do not have mod_proxy enabled – tomaszs Oct 2 '09 at 6:46
In that case, the entry for might simply be misleading. I just tried the same thing on one of my lighttpd servers, and although it gave me an "HTTP/1.1 200 OK" code (which indicates success), the file it actually returned was the index.html on my local server, which is what my index-file.names is set to. Given that, I think you are seeing people trying to proxy through your lighttpd server, but lighttpd is rejecting or ignoring their requests (which is what it should do). Nothing to worry about. – James Sneeringer Oct 2 '09 at 13:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.