Recently seeing a bunch of 400s

[Neil Sheth]

Just an update -

Looking at a tcpdump for a specific case, figuring that basically a
first packet comes, but our server didn't expect it (could be due to
the fact that there was no original handshake to establish the
connection or our server closed the connection but the remote machine
didn't get the packet to realize it was closed), that's why our host
replies with RST flag, saying that the packet was unexpected and that
the record of the connection should be closed on the other side. And
it records it with the 400 error in the access file, logging that some
garbage came, and that it correctly reset the connection.

Not sure what's causing that.  I happened to get one of our users on
the phone, who's experiencing this.  If she connects directly to one
of our backend webservers, the request is successful.  Connecting to
our front-end nginx box, however, gives nothing but 400s and the
following error message in her browser:
he connection to the server was reset while the page was loading
the network link was interrupted while negotiating a connection

Any additional thoughts? Could be a problem with networking or routing?

On Wed, Dec 3, 2008 at 9:18 AM, Arvind Jayaprakash <work at anomalizer.net> wrote:
> Neil Sheth wrote:
>>
>> Hello,
>>
>> I'm seeing a bunch of entries like the following in my nginx access log:
>>
>> 88.147.21.24 - - [02/Dec/2008:04:16:43 -0600] "-" 400 0 "-" "-"
>> 72.14.204.136 - - [02/Dec/2008:04:16:43 -0600] "-" 400 0 "-" "-"
>> 88.147.21.24 - - [02/Dec/2008:04:16:46 -0600] "-" 400 0 "-" "-"
>> 88.147.21.24 - - [02/Dec/2008:04:16:48 -0600] "-" 400 0 "-" "-"
>> 88.147.21.24 - - [02/Dec/2008:04:16:51 -0600] "-" 400 0 "-" "-"
>> 72.39.110.147 - - [02/Dec/2008:04:16:53 -0600] "-" 400 0 "-" "-"
>> 88.147.21.24 - - [02/Dec/2008:04:16:54 -0600] "-" 400 0 "-" "-"
>> 67.165.72.106 - - [02/Dec/2008:04:16:56 -0600] "-" 400 0 "-" "-"
>> 88.147.21.24 - - [02/Dec/2008:04:16:57 -0600] "-" 400 0 "-" "-"
>> 82.37.232.219 - - [02/Dec/2008:04:17:00 -0600] "-" 400 0 "-" "-"
>> 220.255.7.179 - - [02/Dec/2008:04:17:39 -0600] "-" 400 0 "-" "-"
>> 220.255.7.218 - - [02/Dec/2008:04:17:39 -0600] "-" 400 0 "-" "-"
>> 72.21.243.194 - - [02/Dec/2008:04:17:41 -0600] "-" 400 0 "-" "-"
>> 220.255.7.141 - - [02/Dec/2008:04:17:41 -0600] "-" 400 0 "-" "-"
>> 220.255.7.162 - - [02/Dec/2008:04:17:42 -0600] "-" 400 0 "-" "-"
>> 220.255.7.184 - - [02/Dec/2008:04:17:42 -0600] "-" 400 0 "-" "-"
>
> The first dash indicates that the server did not receive a legal http
> request. So there was a network connection to the port, but no http request
> was sent on it.
>
> You would need a network dump to figure out what bytes are being sent if any
> for these connections. This is almost certainly not a problem with this
> instance of nginx; the problem should be elsewhere.
>
>