Apache and 408s

[PsyeX]

Try this just for fun...

"cat access_log|grep NNNN"

yup that will prolly display loads of garbage

"cat access_log|grep NNNN|wc -l"

that should tell you how many occurances of it

I've found that 408's are caused by those icky machines infected with
Codered scanning the internet for more machines to infect.

- Nathan

-----Original Message-----
From: linux-admin at lists.samba.org [mailto:linux-admin at lists.samba.org]
On Behalf Of Peter Barker
Sent: Monday, September 17, 2001 5:14 PM
To: Lots of People
Subject: Apache and 408s

All,

	How many sysadmins out there have been seeing lots of 408s in
their error logs? e.g.

zzz.32.124.98 - - [17/Sep/2001:17:13:59 +1000] "-" 408 -

	408 is HTTPish for "request timed out" - seems like people are
connecting and then not sending their request through.

	Anybody have any clues what it is? Seems rather odd for a
portscan, since they should probably disconnect after scanning the port,
and not time out.

Thanks,
-- 
Peter Barker                          |   N    _--_|\ /---- Barham, Vic 
Programmer,Sysadmin,Geek              | W + E /     /\                
pbarker at barker.dropbear.id.au         |   S   \_,--?_*<-- Canberra      
You need a bigger hammer.             |             v    [35S, 149E]   
"When used legally and in its intended fashion, the Acrobat eBook Reader
 secures eBooks purchased by locking the eBook to the hardware from
which
 it was purchased." -- Adobe press release