strange apache access log

This is a discussion on strange apache access log within the Linux Web Servers forums, part of the Web Server and Related Forums category; i can grep many strange apache log on my server, see below: ::1 - - [13/Mar/2008:14:37:25 +0800] &...


Go Back   Usenet Forums > Web Server and Related Forums > Linux Web Servers

FAQ Members List Calendar Search Today's Posts Mark Forums Read
  #1 (permalink)  
Old 03-13-2008
ssmaxsuper@gmail.com
 
Posts: n/a
Default strange apache access log

i can grep many strange apache log on my server, see below:

::1 - - [13/Mar/2008:14:37:25 +0800] "GET /" 400 460 "-" "-"
::1 - - [13/Mar/2008:14:37:28 +0800] "GET /" 400 460 "-" "-"
::1 - - [13/Mar/2008:14:37:30 +0800] "GET /" 400 460 "-" "-"
::1 - - [13/Mar/2008:14:38:04 +0800] "GET /" 400 460 "-" "-"
::1 - - [13/Mar/2008:14:38:05 +0800] "GET /" 400 460 "-" "-"
::1 - - [13/Mar/2008:14:40:30 +0800] "GET /" 400 460 "-" "-"
::1 - - [13/Mar/2008:14:40:33 +0800] "GET /" 400 460 "-" "-"
::1 - - [13/Mar/2008:14:41:21 +0800] "GET /" 400 460 "-" "-"
::1 - - [13/Mar/2008:14:42:46 +0800] "GET /" 400 460 "-" "-"
::1 - - [13/Mar/2008:14:44:29 +0800] "GET /" 400 460 "-" "-"
::1 - - [13/Mar/2008:14:44:30 +0800] "GET /" 400 460 "-" "-"
::1 - - [13/Mar/2008:14:44:31 +0800] "GET /" 400 460 "-" "-"
::1 - - [13/Mar/2008:14:44:32 +0800] "GET /" 400 460 "-" "-"
::1 - - [13/Mar/2008:14:44:33 +0800] "GET /" 400 460 "-" "-"
::1 - - [13/Mar/2008:14:44:34 +0800] "GET /" 400 460 "-" "-"
::1 - - [13/Mar/2008:14:44:35 +0800] "GET /" 400 460 "-" "-"
::1 - - [13/Mar/2008:14:44:36 +0800] "GET /" 400 460 "-" "-"
::1 - - [13/Mar/2008:14:44:37 +0800] "GET /" 400 460 "-" "-"
::1 - - [13/Mar/2008:14:44:39 +0800] "GET /" 400 460 "-" "-"
::1 - - [13/Mar/2008:14:44:42 +0800] "GET /" 400 460 "-" "-"
::1 - - [13/Mar/2008:14:44:44 +0800] "GET /" 400 460 "-" "-"
::1 - - [13/Mar/2008:14:44:47 +0800] "GET /" 400 460 "-" "-"

the ip is "::1" , i don't what's that mean?
anybody knows how these record appear?? attack or other things? thanks
a lot....

my server is rhel4 and apache version :

Server version: Apache/2.2.6 (Unix)
Server built: Sep 21 2007 12:47:15
Server's Module Magic Number: 20051115:5
Server loaded: APR 1.2.11, APR-Util 1.2.10
Compiled using: APR 1.2.11, APR-Util 1.2.10
Architecture: 32-bit
Server MPM: Prefork
threaded: no
forked: yes (variable process count)
Server compiled with....
-D APACHE_MPM_DIR="server/mpm/prefork"
-D APR_HAS_SENDFILE
-D APR_HAS_MMAP
-D APR_HAVE_IPV6 (IPv4-mapped addresses enabled)
-D APR_USE_SYSVSEM_SERIALIZE
-D APR_USE_PTHREAD_SERIALIZE
-D SINGLE_LISTEN_UNSERIALIZED_ACCEPT
-D APR_HAS_OTHER_CHILD
-D AP_HAVE_RELIABLE_PIPED_LOGS
-D DYNAMIC_MODULE_LIMIT=128
-D HTTPD_ROOT="/home/apache"
-D SUEXEC_BIN="/home/apache/bin/suexec"
-D DEFAULT_PIDLOG="logs/httpd.pid"
-D DEFAULT_SCOREBOARD="logs/apache_runtime_status"
-D DEFAULT_LOCKFILE="logs/accept.lock"
-D DEFAULT_ERRORLOG="logs/error_log"
-D AP_TYPES_CONFIG_FILE="conf/mime.types"
-D SERVER_CONFIG_FILE="conf/httpd.conf"
  #2 (permalink)  
Old 03-13-2008
C.
 
Posts: n/a
Default Re: strange apache access log

On 13 Mar, 07:05, ssmaxsu...@gmail.com wrote:
> i can grep many strange apache log on my server, see below:

<snip>
> the ip is "::1" , i don't what's that mean?
> anybody knows how these record appear?? attack or other things? thanks
> a lot....


IIRC, localhost in ipv6 talk

C.
  #3 (permalink)  
Old 03-14-2008
ssmaxsuper@gmail.com
 
Posts: n/a
Default Re: strange apache access log

On 3月13日, 下午9时46分, "C." <colin.mckin...@gmail.com> wrote:
> On 13 Mar, 07:05, ssmaxsu...@gmail.com wrote:
>
> > i can grep many strange apache log on my server, see below:

> <snip>
> > the ip is "::1" , i don't what's that mean?
> > anybody knows how these record appear?? attack or other things? thanks
> > a lot....

>
> IIRC, localhost in ipv6 talk
>
> C.


but "::1" is a correct ipv6 address ?
my server only use ipv4, should i disable the ipv6 module ??.....
  #4 (permalink)  
Old 03-14-2008
phantom
 
Posts: n/a
Default Re: strange apache access log

<ssmaxsuper@gmail.com> wrote in message
news:08c4106a-8643-45d9-b228-fe0e8351b974@i29g2000prf.googlegroups.com...
>
> but "::1" is a correct ipv6 address ?


Yes it is, '::' represents all other nibbles to be '0'


  #5 (permalink)  
Old 03-14-2008
ssmaxsuper@gmail.com
 
Posts: n/a
Default Re: strange apache access log

On 3月14日, 下午5时01分, "phantom" <nob...@blueyonder.invalid> wrote:
> <ssmaxsu...@gmail.com> wrote in message
>
> news:08c4106a-8643-45d9-b228-fe0e8351b974@i29g2000prf.googlegroups.com...
>
>
>
> > but "::1" is a correct ipv6 address ?

>
> Yes it is, '::' represents all other nibbles to be '0'


oh, thanks , i know nothing of ipv6...
ipv6 will take a long time to replace ipv4 in china i think...
  #6 (permalink)  
Old 03-14-2008
ssmaxsuper@gmail.com
 
Posts: n/a
Default Re: strange apache access log

On 3月14日, 下午5时01分, "phantom" <nob...@blueyonder.invalid> wrote:
> <ssmaxsu...@gmail.com> wrote in message
>
> news:08c4106a-8643-45d9-b228-fe0e8351b974@i29g2000prf.googlegroups.com...
>
>
>
> > but "::1" is a correct ipv6 address ?

>
> Yes it is, '::' represents all other nibbles to be '0'


i use tcpdump -A -s0 -i any tcp src host ::1
find that it's Apache internal dummy connection
then google and there is no offical document about this...
i think that will not heavy the server load...
 


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are Off
[IMG] code is Off
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On



All times are GMT +1. The time now is 04:48 PM.


Powered by vBulletin® Version 3.6.8
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO 3.0.0