Oddities in server log

Question

I have a logging script set up on my site so that whenever you go to the site, the script logs the time, user agent, IP address, referrer, and what page you went to. For some reason, as I was looking at my log, I found that there are several places in which all that is in the log is a time and IP address. No user agent and no requested page. No referrer either, but that is fairly normal. I checked the IP addresses and most are from weird places like Hong Kong. Any ideas on the cause of this, and should I be worried?

Answer 1

It looks to me like somebody using telnet or another network tool to probe your web server.

From the sample you show it looks like somebody is doing something like:

   telnet yourhost 80

   GET / <ENTER>
   <ENTER>

or telnet yourhost 80

   GET / HTTP/1.0<ENTER>
   Host:<ENTER>

You will see you can reproduce the access log with those commands like I did:

127.0.0.1 - - [31/May/2011:22:37:35 -0500] "GET /" 200 177 "-" "-"
127.0.0.1 - - [31/May/2011:22:37:53 -0500] "GET / HTTP/1.0" 200 453 "-" "-"
127.0.0.1 - - [31/May/2011:22:38:35 -0500] "GET / HTTP/1.1" 200 484 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

I would check if I can reproduce it that way. And then search who is the owner of those IPs.