RE: strange apache log entry

From: Kurc, Marcin A. (makurcat_private)
Date: Mon Aug 12 2002 - 10:33:31 PDT

  • Next message: Axel Beckert: "Re: strange apache log entry"

    ::1 =
    ipv6     ipv4
    nothing unusual, Apache is logging ipv6.
    Marcin Kurc
    CAD Systems Administrator
    Cooper-Standard Automotive 
    -----Original Message-----
    From: nargaat_private [mailto:nargaat_private]
    Sent: Saturday, August 10, 2002 11:50 AM
    To: incidentsat_private
    Subject: strange apache log entry
    Yesterday I saw this in my logs (apache 2.0.39 acces_log):
    ::1 - - [10/Aug/2002:00:25:56 +0200] "CONNECT :::2121 HTTP/1.1" 400 267
    ::1 - - [10/Aug/2002:00:33:31 +0200] "CONNECT :::2121 HTTP/1.1" 400 267
    [Sat Aug 10 00:25:56 2002] [error] [client ::1] request failed: error
    reading the 
    [Sat Aug 10 00:33:31 2002] [error] [client ::1] request failed: error
    reading the 
    It seems like someone wants to connect to my port 2121 through a proxy. The
    thing is, that there isn't any ip. My firewall (SuSEfirewall, an ipchains
    firewall from suse), didn't log anything, snort didn't log anything too. I
    able to reproduce this by sending the request manually to port 80.
    My question: is this a bug in apache, or what else happened?
    GMX - Die Kommunikationsplattform im Internet.
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see:

    This archive was generated by hypermail 2b30 : Mon Aug 12 2002 - 11:31:37 PDT