Hello again, well... you were right!! They are receiving 404's... At least that is what access.log is reporting. However, when I tried what Mathias Tauber said, I got the source code for the root "index.html" instead of 404... very strange! Can this be explained?
If you answer, please send a copy to me, since I am not currently on the list. Thanks for all the responses, Roberto On Tue, 09 Nov 2004 17:57:39 +0100, Mathias Tauber <[EMAIL PROTECTED]> wrote: > Hi, > > > > >>Er... sorry to all, but I just noticed that I am STILL getting a lot > >>of requests (sorry for marking this as solved!... my mistake). > > > > > > Maybe some of the websites 'abusing' you still have you listed as an open > > proxy. This would mean the requests are made, but not succesfully answered > > by your server. > > > > For example, you should worry if your access log shows: > > > > 10.0.0.31 - - [09/Nov/2004:17:27:01 +0100] "GET /apache2-default/ HTTP/1.1" > > 200 1969 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET > > CLR 1.1.4322)" > > > > Since the '200' after the request (the GET) means succesfull. > > > > However, you should not worry if your access log shows: > > > > 193.147.68.144 - - [09/Nov/2004:02:14:22 +0100] "GET > > /scripts/..%255c%255c../winnt/system32/cmd.exe?/c+dir" 404 346 "-" "-" > > 193.147.68.141 - - [09/Nov/2004:08:16:54 +0100] "GET > > /scripts/..%255c%255c../winnt/system32/cmd.exe?/c+dir" 404 346 "-" "-" > > > > Since the '404' after the request (the GET) means failed. > > that's right! 404 is the correct result code, if they are still trying > to use your server as a proxy. Don't be scared, that's normal... > > You can also test this by yourself by using telnet. Just do this: > > telnet your.server.ip 80 > > You will then receive this: > > Trying your.server.ip... > Connected to your.server.ip. > Escape character is '^]'. > > After this enter the following: > > GET http://www.google.com HTTP/1.0 > > Now press enter twice! You will then receive HTML-Code, but > not the one from google ;O) > > You will receive your standard 404 error page and so always > the same for all requests of this kind. You can also see in > the logfile after the result code 404 the size (bytes) of > the response from your server. This should now always be the > same and if you compare this to your earlier logs, you'll > see the difference. > > > Mathias > > -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
