Re: How will i block this kind of request

From: Alan J Rosenthal (flaps_at_dgp.toronto.edu)
Date: 09/06/03

  • Next message: Matt Blaze: "USENIX Secuirty '04 Call for Papers" 
    Date: 6 Sep 2003 16:52:14 GMT

    sundaram@percipia.com (Sundaram Ramasamy) writes:
    >I am getting this kind of log message on my web server log. How will i
    >block this kind of request.
    >
    >64.140.34.130 - - [04/Sep/2003:16:51:28 -0400] "GET /default.ida?XXXXXXXXXXXX
    ...
    >31b%u53ff%u0078%u0000%u00=a HTTP/1.0" 404 284

    That "404" is your web server saying "sorry". I'd say it _is_ blocked,
    in any relevant sense. They say "default.ida", you say "sorry".

    Now, I think you want your web server to tell them "*** off" instead of
    merely "sorry". But if a new code were standardized with that meaning and
    your web server returned, say, 416 instead of 404, I promise you you'd find it
    strangely unsatisfying.

    Perhaps you just don't want to see it in the logs. For that, I think you
    need better log-viewing software. It's best to log a lot and view it with
    appropriate blinders, rather than to suppress logs you might want later.

  • Next message: Matt Blaze: "USENIX Secuirty '04 Call for Papers"
    • Quantcast