Re: Apache log entries

From: David (thunderbolt01@netscape.net)
Date: 02/27/03 

From: David <thunderbolt01@netscape.net>
Date: Thu, 27 Feb 2003 20:06:32 GMT

Kim S. Poulsen wrote:
> I have been getting a lot of entries like this in my Apache access log
> recently. Besides trying to use my server as a mail proxy.
> Does anybody know what is the "\x05\x01\" is supposed to do?
> xxx.xx.dk 200.46.116.62 - - [23/Feb/2003:21:58:44 +0100] "CONNECT
> 200.24.139.146:25 HTTP/1.0" 200 849 "-" "-"
> xxx.xx.dk 200.46.116.62 - - [24/Feb/2003:01:43:41 +0100] "\x05\x01"
> 200 849 "-" "-"
> xxx.xx.dk 200.46.116.62 - - [24/Feb/2003:02:23:47 +0100] "\x05\x01"
> 200 849 "-" "-"

I've had some of the same messages but with different messages.
NOTE the: 501 and 405 error messages.

211.94.240.27 - - [16/Feb/2003:03:03:27 -0600] "\x04\x01" 501 -
211.94.240.27 - - [16/Feb/2003:03:03:48 -0600] "\x05\x01" 501 -
211.94.240.27 - - [16/Feb/2003:03:03:51 -0600] "CONNECT
207.46.181.13:25 HTTP/1.1" 405 313

Yours shows a 200 message which is a successful response.

200 (%>s)
     This is the status code that the server sends back to the
client. This information is very valuable, because it reveals
whether the request resulted in a successful response (codes
beginning in 2), a redirection (codes beginning in 3), an error
caused by the client (codes beginning in 4), or an error in the
server (codes beginning in 5). The full list of possible status
codes can be found in the HTTP specification (RFC2616 section 10). 

-- 
Confucius:  He who play in root, eventually kill tree.
Registered with the Linux Counter.  http://counter.li.org
Slackware 9.0-beta Linux 2.4.20tbls i686 (GCC) 3.2.2
Uptime: 7 days, 22:22, 1 user, load average: 1.10, 1.05, 1.06

Relevant Pages

  • Re: Passplay BIOS Levels Re: RAID controller
    ... Or - to be precise - the return codes. ... Initial code worked only with early Passplay board releases. ... Sometimes drives were set to "DDD" state when they failed ... The RAID card is in a PC server 330, ...
    (comp.sys.ibm.ps2.hardware)
  • Re: 1 Machine, 2 NICs, 2 Instances of ntpd; Possible?
    ... The intended model for monitoring and control is clearly articulated in the control and monitoring protocol defined in rfc 1305. ... This model provides status words and event codes explicitly designed for remote access and as a demarcation between the idiosyncratic inner workings of the implementation and the external view. ... valid server to even the most primitive of valid clients without them. ...
    (comp.protocols.time.ntp)
  • Re: 501 --- reserved for future use ---
    ... " 4.2.2 Numeric Order List of Reply Codes". ... the FTP server is 501 and the "client error code" is an "Error reply ... All FTP server replies begin with a 3-digit number. ... methods to view posts. ...
    (bit.listserv.ibm-main)
  • Re: Sonderzeichen werden aus Stream gefiltert
    ... müsste UTF-8 auch gehen.... ... vielleicht kommt schon/sonst was falsches vom Server? ... Ich würde (beim Client) mal zB einen 'BinaryReader' nehmen und ... dann _genau_ die Codes anschauen... ...
    (microsoft.public.de.german.entwickler.dotnet.csharp)
  • Re: 1 Machine, 2 NICs, 2 Instances of ntpd; Possible?
    ... The intended model for monitoring and control is clearly articulated in the control and monitoring protocol defined in rfc 1305. ... The values in question are needed to correctly construct a server response packet, so, it you split client and server, you must communicate this information between them. ... The intent of the original design which continues today is that a small perl script can be used to query ntpd, parse the codes and traps and either beep the administrator or respond as an SNMP agent. ...
    (comp.protocols.time.ntp)