host ip addr missing from access log during DOS attack

I am searching for an explanation as to how the access log could have
not recorded the host ip address if it is configured to record it and
normally does. I
don't think that escape character sequences are playing a part here,
since viewing the log with the vi editor displays what is shown below.

Please see log snippet below. Notice that the ip address of the
previous host is recorded (as usual), but beginning with the 4th
record there is only :: where the ip should be. These log entries
recorded the beginning of a DOS attack on the server.

Does anybody know how this could happen?


192.168.20.33 - - [04/Oct/2007:11:09:41 -0700] "GET / HTTP/1.1" 200
9066 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR
1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; InfoPath.2)"
192.168.20.33 - - [04/Oct/2007:11:09:41 -0700] "GET / HTTP/1.1" 200
9071 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR
1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; InfoPath.2)"
192.168.20.33 - - [04/Oct/2007:11:09:41 -0700] "GET / HTTP/1.1" 200
9070 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR
1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; InfoPath.2)"
:: - - [04/Oct/2007:11:09:42 -0700] "GET / HTTP/1.1" 200 9077 "-"
"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322;
..NET CLR 2.0.50727; .NET CLR 3.0.04506.30; InfoPath.2)"
:: - - [04/Oct/2007:11:09:42 -0700] "GET / HTTP/1.1" 200 9065 "-"
"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322;
..NET CLR 2.0.50727; .NET CLR 3.0.04506.30; InfoPath.2)"
:: - - [04/Oct/2007:11:09:43 -0700] "GET / HTTP/1.1" 200 9070 "-"
"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322;
..NET CLR 2.0.50727; .NET CLR 3.0.04506.30; InfoPath.2)"
:: - - [04/Oct/2007:11:09:43 -0700] "GET / HTTP/1.1" 200 9107 "-"
"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322;
..NET CLR 2.0.50727; .NET CLR 3.0.04506.30; InfoPath.2)"
:: - - [04/Oct/2007:11:09:43 -0700] "GET / HTTP/1.1" 200 9108 "-"
"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322;
..NET CLR 2.0.50727; .NET CLR 3.0.04506.30; InfoPath.2)"
:: - - [04/Oct/2007:11:09:43 -0700] "GET / HTTP/1.1" 200 9108 "-"
"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322;
..NET CLR 2.0.50727; .NET CLR 3.0.04506.30; InfoPath.2)"
:: - - [04/Oct/2007:11:09:44 -0700] "GET / HTTP/1.1" 200 9064 "-"
"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322;
..NET CLR 2.0.50727; .NET CLR 3.0.04506.30; InfoPath.2)"
:: - - [04/Oct/2007:11:09:44 -0700] "GET / HTTP/1.1" 200 9064 "-"
"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322;
..NET CLR 2.0.50727; .NET CLR 3.0.04506.30; InfoPath.2)"
:: - - [04/Oct/2007:11:09:44 -0700] "GET / HTTP/1.1" 200 9081 "-"
"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322;
..NET CLR 2.0.50727; .NET CLR 3.0.04506.30; InfoPath.2)"
:: - - [04/Oct/2007:11:09:44 -0700] "GET / HTTP/1.1" 200 9068 "-"
"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322;
..NET CLR 2.0.50727; .NET CLR 3.0.04506.30; InfoPath.2)"

On 6 Nov, 18:26, canonical.fo...@gmail.com wrote:
> I am searching for an explanation as to how the access log could have
> not recorded the host ip address if it is configured to record it and
> normally does. I
> don't think that escape character sequences are playing a part here,
> since viewing the log with the vi editor displays what is shown below.
>
> Please see log snippet below. Notice that the ip address of the
> previous host is recorded (as usual), but beginning with the 4th
> record there is only :: where the ip should be. These log entries
> recorded the beginning of a DOS attack on the server.
>
> Does anybody know how this could happen?
>
> 192.168.20.33 - - [04/Oct/2007:11:09:41 -0700] "GET / HTTP/1.1" 200
> 9066 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR
> 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; InfoPath.2)"
<snip>
> :: - - [04/Oct/2007:11:09:42 -0700] "GET / HTTP/1.1" 200 9077 "-"
> "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322;
> .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; InfoPath.2)"

IIRC '::' would be the abbreviated IPV6 address for
0000:0000:0000:0000:0000:0000:0000:0000 or 'unspecified address'. But
I don't know a lot^H^H^Hanything about IPV6.

from http://www.tcpipguide.com/free/t_IPv...alSiteLo-2.htm
<quote>
In IPv4, an IP address of all zeroes has a special meaning; it refers
to the host itself, and is used when a device doesn't know its own
address. In IPv6 this concept has been formalized, and the all-zeroes
address (0:0:0:0:0:0:0:0) is named the unspecified address. It is
typically used in the source field of a datagram sent by a device
seeking to have its IP address configured. Zero compression can be
applied to this address; since it is all zeroes, the address becomes
just "::". (I consider this confusing, myself. I think something like
"0::0" is a lot more clear, and short enough.)
<quote />

.....which rather suggests to me it should NOT be routed?

HTH

C.