Hello. We have just rolled out a major load-balanced tomcat installation. Currently we're seeing instances in the access logs where HTTP GETs are "hijacked", ie:
10.10.10.10 - - [10/Jun/2007:16:08:42 +0200] "GET /svt_se/css/global/cssimg/logo/chLogoSVT1.gif HTTP/1.0" 200 287 "null" "Wget/1.10.2 (Red Hat modified)" 10.10.10.10 - - [10/Jun/2007:16:08:42 +0200] "GET /svt_se/css/global/cssimg/logo/chLogoSVT2.gif HTTP/1.0" 200 305 "null" "Wget/1.10.2 (Red Hat modified)" 10.10.10.10 - - [10/Jun/2007:16:08:42 +0200] "GET /svt_se/css/mobile/SGM.css HTTP/1.1" 200 4807 "http://mobil.svt.se/svt/jsp/Crosslink.jsp?d=26909"; "SonyEricssonW610i/R1JD Browser/NetFront/3.3 Profile/MIDP-2.0 Configuration/CLDC-1.1" 10.10.10.10 - - [10/Jun/2007:16:08:42 +0200] "GET /svt_se/css/global/cssimg/play/video.gif HTTP/1.0" 200 150 "null" "Wget/1.10.2 (Red Hat modified)" ... 10.10.10.2 - - [10/Jun/2007:16:08:43 +0200] "GET /content/2/c6/02/70/51/news3.css HTTP/1.1" 200 661 "http://mobil.svt.se/svt/jsp/Crosslink.jsp?d=26909"; "SonyEricssonW610i/R1JD Browser/NetFront/3.3 Profile/MIDP-2.0 Configuration/CLDC-1.1" 10.10.10.10 is the (staged for your purpose, of course) IP of a management machine that we among other things use to test traffic, 10.10.10.2 is a Sun 2120 load balancer accepting live traffic from mobile phones. This is a fairly common event which results in a seemingly random content delivery to the web client. In other words, our test client does a GET but recieves the content of the GET that the mobile phone client is interested in. When we look at the client-end logs, we see: --16:08:42-- http://localhost:8181/svt_se/css/global/cssimg/logo/chLogoSVT2.gif Reusing existing connection to localhost:8181. HTTP request sent, awaiting response... HTTP/1.1 200 OK Server: Apache-Coyote/1.1 ETag: W/"305-1181455426000" Last-Modified: Sun, 10 Jun 2007 06:03:46 GMT Content-Type: image/gif Content-Length: 305 Date: Sun, 10 Jun 2007 14:08:42 GMT Connection: keep-alive Length: 305 [image/gif] Saving to: `curr/chLogoSVT2.gif' 0K 100% 26.4M=0s 16:08:42 (26.4 MB/s) - `curr/chLogoSVT2.gif' saved [305/305] --16:08:42-- http://localhost:8181/svt_se/css/global/cssimg/logo/chLogoSVTEuropa.gif Reusing existing connection to localhost:8181. HTTP request sent, awaiting response... HTTP/1.1 200 OK Server: Apache-Coyote/1.1 ETag: W/"4807-1181455426000" Last-Modified: Sun, 10 Jun 2007 06:03:46 GMT Content-Type: text/css Content-Length: 4807 Date: Sun, 10 Jun 2007 14:08:42 GMT Length: 4807 (4.7K) [text/css] Saving to: `curr/chLogoSVTEuropa.gif' 0K .... 100% 287M=0s 16:08:42 (287 MB/s) - `curr/chLogoSVTEuropa.gif' saved [4807/4807] --16:08:42-- http://localhost:8181/svt_se/css/global/cssimg/play/video.gif ... One thing which immediately strikes us is that the keep-alive HTTP response is missing, and that the ETag and the Content-Type is quite correct for the file which we have actually recieved, which is the CSS mentioned above. We've seen this both for static and dynamic content, though however mostly for images since the majority of our GETs are [image/*]. Technical specs: Tomcat 6.0.13 JRE 1.5.0_07 SunOS 5.10 Generic_125101-01 i86pc i386 i86pc Two Sun 2120 load balancers delivering requests to this specific tomcat instance. Best regards, Ola Sundell
