This is a discussion on strange apache access log within the Linux Web Servers forums, part of the Web Server and Related Forums category; i can grep many strange apache log on my server, see below: ::1 - - [13/Mar/2008:14:37:25 +0800] &...
|
|||||||
| FAQ | Members List | Calendar | Search | Today's Posts | Mark Forums Read |
|
|||
|
i can grep many strange apache log on my server, see below:
::1 - - [13/Mar/2008:14:37:25 +0800] "GET /" 400 460 "-" "-" ::1 - - [13/Mar/2008:14:37:28 +0800] "GET /" 400 460 "-" "-" ::1 - - [13/Mar/2008:14:37:30 +0800] "GET /" 400 460 "-" "-" ::1 - - [13/Mar/2008:14:38:04 +0800] "GET /" 400 460 "-" "-" ::1 - - [13/Mar/2008:14:38:05 +0800] "GET /" 400 460 "-" "-" ::1 - - [13/Mar/2008:14:40:30 +0800] "GET /" 400 460 "-" "-" ::1 - - [13/Mar/2008:14:40:33 +0800] "GET /" 400 460 "-" "-" ::1 - - [13/Mar/2008:14:41:21 +0800] "GET /" 400 460 "-" "-" ::1 - - [13/Mar/2008:14:42:46 +0800] "GET /" 400 460 "-" "-" ::1 - - [13/Mar/2008:14:44:29 +0800] "GET /" 400 460 "-" "-" ::1 - - [13/Mar/2008:14:44:30 +0800] "GET /" 400 460 "-" "-" ::1 - - [13/Mar/2008:14:44:31 +0800] "GET /" 400 460 "-" "-" ::1 - - [13/Mar/2008:14:44:32 +0800] "GET /" 400 460 "-" "-" ::1 - - [13/Mar/2008:14:44:33 +0800] "GET /" 400 460 "-" "-" ::1 - - [13/Mar/2008:14:44:34 +0800] "GET /" 400 460 "-" "-" ::1 - - [13/Mar/2008:14:44:35 +0800] "GET /" 400 460 "-" "-" ::1 - - [13/Mar/2008:14:44:36 +0800] "GET /" 400 460 "-" "-" ::1 - - [13/Mar/2008:14:44:37 +0800] "GET /" 400 460 "-" "-" ::1 - - [13/Mar/2008:14:44:39 +0800] "GET /" 400 460 "-" "-" ::1 - - [13/Mar/2008:14:44:42 +0800] "GET /" 400 460 "-" "-" ::1 - - [13/Mar/2008:14:44:44 +0800] "GET /" 400 460 "-" "-" ::1 - - [13/Mar/2008:14:44:47 +0800] "GET /" 400 460 "-" "-" the ip is "::1" , i don't what's that mean? anybody knows how these record appear?? attack or other things? thanks a lot.... my server is rhel4 and apache version : Server version: Apache/2.2.6 (Unix) Server built: Sep 21 2007 12:47:15 Server's Module Magic Number: 20051115:5 Server loaded: APR 1.2.11, APR-Util 1.2.10 Compiled using: APR 1.2.11, APR-Util 1.2.10 Architecture: 32-bit Server MPM: Prefork threaded: no forked: yes (variable process count) Server compiled with.... -D APACHE_MPM_DIR="server/mpm/prefork" -D APR_HAS_SENDFILE -D APR_HAS_MMAP -D APR_HAVE_IPV6 (IPv4-mapped addresses enabled) -D APR_USE_SYSVSEM_SERIALIZE -D APR_USE_PTHREAD_SERIALIZE -D SINGLE_LISTEN_UNSERIALIZED_ACCEPT -D APR_HAS_OTHER_CHILD -D AP_HAVE_RELIABLE_PIPED_LOGS -D DYNAMIC_MODULE_LIMIT=128 -D HTTPD_ROOT="/home/apache" -D SUEXEC_BIN="/home/apache/bin/suexec" -D DEFAULT_PIDLOG="logs/httpd.pid" -D DEFAULT_SCOREBOARD="logs/apache_runtime_status" -D DEFAULT_LOCKFILE="logs/accept.lock" -D DEFAULT_ERRORLOG="logs/error_log" -D AP_TYPES_CONFIG_FILE="conf/mime.types" -D SERVER_CONFIG_FILE="conf/httpd.conf" |
|
|||
|
On 13 Mar, 07:05, ssmaxsu...@gmail.com wrote:
> i can grep many strange apache log on my server, see below: <snip> > the ip is "::1" , i don't what's that mean? > anybody knows how these record appear?? attack or other things? thanks > a lot.... IIRC, localhost in ipv6 talk C. |
|
|||
|
On 3月13日, 下午9时46分, "C." <colin.mckin...@gmail.com> wrote:
> On 13 Mar, 07:05, ssmaxsu...@gmail.com wrote: > > > i can grep many strange apache log on my server, see below: > <snip> > > the ip is "::1" , i don't what's that mean? > > anybody knows how these record appear?? attack or other things? thanks > > a lot.... > > IIRC, localhost in ipv6 talk > > C. but "::1" is a correct ipv6 address ? my server only use ipv4, should i disable the ipv6 module ??..... |
|
|||
|
On 3月14日, 下午5时01分, "phantom" <nob...@blueyonder.invalid> wrote:
> <ssmaxsu...@gmail.com> wrote in message > > news:08c4106a-8643-45d9-b228-fe0e8351b974@i29g2000prf.googlegroups.com... > > > > > but "::1" is a correct ipv6 address ? > > Yes it is, '::' represents all other nibbles to be '0' oh, thanks , i know nothing of ipv6... ipv6 will take a long time to replace ipv4 in china i think... |
|
|||
|
On 3月14日, 下午5时01分, "phantom" <nob...@blueyonder.invalid> wrote:
> <ssmaxsu...@gmail.com> wrote in message > > news:08c4106a-8643-45d9-b228-fe0e8351b974@i29g2000prf.googlegroups.com... > > > > > but "::1" is a correct ipv6 address ? > > Yes it is, '::' represents all other nibbles to be '0' i use tcpdump -A -s0 -i any tcp src host ::1 find that it's Apache internal dummy connection then google and there is no offical document about this... i think that will not heavy the server load... |
| Thread Tools | |
| Display Modes | |
|
|