Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
From: Lee Fellows <lfellows@4lane.com>
To: users@httpd.apache.org
In-Reply-To: <006501c2f927$8b9f2a20$1a01a8c0@vishal>
References: <006501c2f927$8b9f2a20$1a01a8c0@vishal>
Content-Type: text/plain
Organization: 
Message-Id: <1049296834.1336.58.camel@darkstar.internal.4lane.com>
Mime-Version: 1.0
Date: 02 Apr 2003 10:20:34 -0500
Content-Transfer-Encoding: 7bit
Subject: Re: [users@httpd] Invalid method in request \x80L\x01\x03

On Wed, 2003-04-02 at 09:52, System wrote:
> Hello All,
> 
> since yesterday httpd logfiles are filling with entries like these:
> 
> [Wed Apr  2 09:43:01 2003] [error] [client 64.133.59.136] Invalid method in
> request \x80L\x01\x03
> 
> Does anybody have seen this before? I never saw the \x??? request stuff
> before. Maybe some kind of DoS attack / exploit attempt?
> 
  This is almost funny.  Didn't we see precisely the same pattern once
  before just recently?  

  What does the corresponding entry in your access_log file look like?

  My guess is someone attempted to access a non-https port using
  the https protocol.  Now whether this was accidental, i.e., someone
  entering https://xxx.xxx.xxx.xxx:80/, or someone attempting to
  correctly access port 443 when the host monitoring that port is not
  configured for SSL, I do not know.  


-- 
Lee Fellows <lfellows@4lane.com>


---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org