400 errors

[Neil Sheth]

We just changed over to another server, so far I don't see this issue
happening, so perhaps it was indeed something related to some sort of faulty
network config.

I do still see some other 400s that I'm trying to track down.  They're
almost all on the same page, it's on a post request to our registration
page.  The entries all look like:

123.45.67.89 - - [09/Dec/2010:21:09:50 -0600] "POST /register.php HTTP/1.1"
400 0 "http://www.site.com/register.php?src=h" "Mozilla/4.0 (compatible;
MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; GTB6.6; SLCC2; .NET CLR
2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)"

It generally seems to be IE that's triggering these (but I see IE6, IE7, and
IE8, so not limited to one version).  I don't find any corresponding errors
in my backend apache logs, nor in the nginx error log.

Any insights would be appreciated.

Thanks!

On Tue, Dec 7, 2010 at 11:28 PM, Neil Sheth <nsheth at gmail.com> wrote:

> I think you may be on to something, we are definitely seeing some weirdness
> at a network level.  I found an older thread of mine, forgot about it, this
> is the same problem.
>
> http://nginx.org/pipermail/nginx/2008-December/008667.html
>
> We're looking at the tcp/ip traffic in more detail, and things do not look
> correct . . .
>
>
> On Tue, Dec 7, 2010 at 8:18 PM, Mikhail Mazursky <ash2kk at gmail.com> wrote:
>
>> 2010/12/8 Neil Sheth <nsheth at gmail.com>:
>> > Hello,
>> >
>> > Something I've been seeing for a long time here - I've posted long ago,
>> but
>> > was never able to find a solution.  Looking at our access logs, I see
>> tons
>> > of lines like (multiple times a minute)
>> > 123.45.6.789 - - [07/Dec/2010:19:05:51 -0600] "-" 400 0 "-" "-"
>> >
>> > I changed my error_log to info, and I see a lot of corresponding entries
>> > like:
>> > recv() failed (104: Connection reset by peer) while reading client
>> request
>> > line
>> >
>> > I also set the following, but it doesn't seem to have helped, as I see a
>> lot
>> > of posts about this issue potentially being caused by large cookies:
>> > large_client_header_buffers 8 4k;
>> >
>> > Thoughts?
>>
>> Hello,
>>
>> we used to have issues like this on two of our servers when the router
>> was setup incorrectly and some ip packets of a TCP connection were
>> routed not to the right server. Check your network.
>>
>> _______________________________________________
>> nginx mailing list
>> nginx at nginx.org
>> http://nginx.org/mailman/listinfo/nginx
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://nginx.org/pipermail/nginx/attachments/20101210/80b922e3/attachment.html>