400 bad request errors

[Igor Sysoev]

On Tue, Oct 06, 2009 at 11:53:19AM -0400, pepejose wrote:

> > Igor Sysoev Wrote:
> > -------------------------------------------------------
> > 
> > 
> > Anyway, these bad requests are caused 400 error
> > much early than "return 444".
> > 
> > 
> > -- 
> > Igor Sysoev
> > http://sysoev.ru/en/
> 
> then, 
> 
> in the wiki says this
> 
> "The basic name of server is used in an HTTP redirects, if no Host header was in client request or that header does not match any assigned server_name"
> 
> the response is HTTP 444 if there is the host header but there is no virtualhost defined with same host
> but 400 bad request when no header host in request, however, the sever field equals "_" and not empty

If nginx gets empty request (no any symbol at all) and does not even try
to search virtualhost, etc. It just returns 400.

> all this because every day I have many entries in the access.log like this and want to find out why:

I've shown the ways to emulate such requests:
"telnet host 80", then press Ctrl-D.
It may be some scanners. It may be browser that has started an images
download and has stopped the connection, because user has clicked on a link.

> >>I have in one hour 441
> > > "NULL 400 Bad Requests" made by 45 ips aprox
> > >
> > > example:
> > >
> > > 17 connections: same ip, same second
> > >
> > > IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> > > "-" "-"
> > > IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> > > "-" "-"
> > > IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> > > "-" "-"
> > > IP _ - [01/Oct/2009:09:44:40 +0200] "-" 400 0 "-"
> >>  etc .....


-- 
Igor Sysoev
http://sysoev.ru/en/