400 bad request errors

[Igor Sysoev]

On Tue, Oct 06, 2009 at 10:19:04AM -0400, pepejose wrote:

> pepejose Wrote:
> -------------------------------------------------------
> > hello again! jeje
> > 
> > well, I've been watching the logs again and the
> > report of Logwatch, now with nginx as reverse
> > proxy in front of apache I have in one hour 441
> > "NULL 400 Bad Requests" made by  45 ips aprox
> > 
> > example:
> > 
> > 17 connections: same ip, same second
> > 
> > IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> > "-" "-"
> > IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> > "-" "-"
> > IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> > "-" "-"
> > IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> > "-" "-"
> > IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> > "-" "-"
> > IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> > "-" "-"
> > IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> > "-" "-"
> > IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> > "-" "-"
> > IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> > "-" "-"
> > IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> > "-" "-"
> > IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> > "-" "-"
> > IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> > "-" "-"
> > IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> > "-" "-"
> > IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> > "-" "-"
> > IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> > "-" "-"
> > IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> > "-" "-"
> > IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> > "-" "-" 
> > 
> > 	
> > These amounts are normal with nginx?
> > how can I know the causes of this? 	
> > What can I do?
> > 
> > thanks!! thanks!! thanks!!
> 
> I've been looking at the error.log
> 
> this is the type of error that causes these entries in the access.log
> 
> 2009/10/05 18:26:12  31810#0: *29604 client closed prematurely connection while reading client request line, client: IP, server: _
> 
> 	
> in my configuration file I have the following virtualhost:
> 
>     server {
> 	listen *:80;
>         server_name  _;  #default
>         return 444;
>     }
> 
> 	
> then, why a request without host header generating a response 400 (bad request) and not a 444 as in the case if there is the host header but there is no virtualhost defined with same host?

Do the following:

---
telnet you.host 80
^D
---

or

---
telnet you.host 80
^]
quit
---

then look in logs.


-- 
Igor Sysoev
http://sysoev.ru/en/