Re: Apache log entries

From: Kim S. Poulsen (kspFJERN@akim.dk)
Date: 02/27/03 

From: Kim S. Poulsen <kspFJERN@akim.dk>
Date: Thu, 27 Feb 2003 23:18:10 +0100

On Thu, 27 Feb 2003 20:06:32 GMT, David <thunderbolt01@netscape.net>
wrote:

>Kim S. Poulsen wrote:
>> I have been getting a lot of entries like this in my Apache access log
>> recently. Besides trying to use my server as a mail proxy.
>> Does anybody know what is the "\x05\x01\" is supposed to do?
>> xxx.xx.dk 200.46.116.62 - - [23/Feb/2003:21:58:44 +0100] "CONNECT
>> 200.24.139.146:25 HTTP/1.0" 200 849 "-" "-"
>> xxx.xx.dk 200.46.116.62 - - [24/Feb/2003:01:43:41 +0100] "\x05\x01"
>> 200 849 "-" "-"
>> xxx.xx.dk 200.46.116.62 - - [24/Feb/2003:02:23:47 +0100] "\x05\x01"
>> 200 849 "-" "-"
>
>I've had some of the same messages but with different messages.
>NOTE the: 501 and 405 error messages.
>
>211.94.240.27 - - [16/Feb/2003:03:03:27 -0600] "\x04\x01" 501 -
>211.94.240.27 - - [16/Feb/2003:03:03:48 -0600] "\x05\x01" 501 -
>211.94.240.27 - - [16/Feb/2003:03:03:51 -0600] "CONNECT
>207.46.181.13:25 HTTP/1.1" 405 313
>
>Yours shows a 200 message which is a successful response.
>
>200 (%>s)
> This is the status code that the server sends back to the
>client. This information is very valuable, because it reveals
>whether the request resulted in a successful response (codes
>beginning in 2), a redirection (codes beginning in 3), an error
>caused by the client (codes beginning in 4), or an error in the
>server (codes beginning in 5). The full list of possible status
>codes can be found in the HTTP specification (RFC2616 section 10).
Thanks for your answer.
Yes I have noticed the 200 response. I have tried sending the code
"x05\x01" by telnet and the only thing I see is the HTML code listed
from the web page.

The xxx.xx.dk 200.46.116.62 - - [23/Feb/2003:21:58:44 +0100]
"CONNECT200.24.139.146:25 HTTP/1.0" 200 849 "-" "-" , error code is
wrong (my port 25 is blocked by the ISP routers). I have read
somewhere it's PHP module bug.

But I'm still wondering about the \x05\x01\, I haven't been able to
find something in english about it. A lot in russian and Dutch :-) 

-- 
Kim S. Poulsen

Relevant Pages

  • Re: 1 Machine, 2 NICs, 2 Instances of ntpd; Possible?
    ... The intended model for monitoring and control is clearly articulated in the control and monitoring protocol defined in rfc 1305. ... This model provides status words and event codes explicitly designed for remote access and as a demarcation between the idiosyncratic inner workings of the implementation and the external view. ... valid server to even the most primitive of valid clients without them. ...
    (comp.protocols.time.ntp)
  • Re: 501 --- reserved for future use ---
    ... " 4.2.2 Numeric Order List of Reply Codes". ... the FTP server is 501 and the "client error code" is an "Error reply ... All FTP server replies begin with a 3-digit number. ... methods to view posts. ...
    (bit.listserv.ibm-main)
  • Re: Sonderzeichen werden aus Stream gefiltert
    ... müsste UTF-8 auch gehen.... ... vielleicht kommt schon/sonst was falsches vom Server? ... Ich würde (beim Client) mal zB einen 'BinaryReader' nehmen und ... dann _genau_ die Codes anschauen... ...
    (microsoft.public.de.german.entwickler.dotnet.csharp)
  • Re: Response Code
    ... generated which codes, there's not much more to say. ... the server should take care of this. ... If you run a windows system, then Xenu link checker is amazingly ... However, it uses Windows ...
    (alt.html)
  • Re: 1 Machine, 2 NICs, 2 Instances of ntpd; Possible?
    ... The intended model for monitoring and control is clearly articulated in the control and monitoring protocol defined in rfc 1305. ... The values in question are needed to correctly construct a server response packet, so, it you split client and server, you must communicate this information between them. ... The intent of the original design which continues today is that a small perl script can be used to query ntpd, parse the codes and traps and either beep the administrator or respond as an SNMP agent. ...
    (comp.protocols.time.ntp)