Recently seeing a bunch of 400s

[Neil Sheth]

I'm not fully knowledgeable about the network layer, so my explanation
may have been incorrect.  I asked our hosting provider to look at it,
thinking it could be something they could help with, this was their
response:

---------------------------------------
>From looking over packet dumps I have collected, this appears to be a
client-side issue and not something caused by the server.

The requests resulting in 400 error codes appear to correspond to the
client opening and then closing the connection. In the packet dump, I
see the clients initiate the connection with a SYN and then immediate
close it with FIN, ACK or RST, ACK. Similar behavior exists for 499
errors except the client sends a HTTP request before closing the
connection.

The clients appear to be aborting the connection and then momentarily
later retrying it. Maybe they think the page isn't loading and retry
it.
--------------------------------------------


I see another ongoing thread about 400s with firefox, perhaps I'm
experiencing the same issue.


On Thu, Dec 11, 2008 at 7:17 PM, Dave Cheney <dave at cheney.net> wrote:
>
>> Looking at a tcpdump for a specific case, figuring that basically a
>> first packet comes, but our server didn't expect it (could be due to
>> the fact that there was no original handshake to establish the
>> connection or our server closed the connection but the remote machine
>> didn't get the packet to realize it was closed), that's why our host
>> replies with RST flag, saying that the packet was unexpected and that
>> the record of the connection should be closed on the other side. And
>> it records it with the 400 error in the access file, logging that some
>> garbage came, and that it correctly reset the connection.
>
> That doesn't make sense. If you send a packet to a port without
> establishing a connection you'll get a RST, but that comes from the tcp
> stack, the application waiting on select() or accept() will be completely
> unaware of the failed connection attempt. Unless, of course, there is a bug
> in your OS's TCP stack.
>
> Cheers
>
> Dave
>
>