From owner-freebsd-security Sun Nov 4 11:19:57 2001 Delivered-To: freebsd-security@freebsd.org Received: from smtp.clifftop.net (machassociates-6.dsl.easynet.co.uk [217.204.162.182]) by hub.freebsd.org (Postfix) with ESMTP id 9D5C537B418 for ; Sun, 4 Nov 2001 11:19:37 -0800 (PST) Received: from sisko (sisko.clifftop.net [192.168.1.10]) (authenticated bits=0) by smtp.clifftop.net (8.12.1/8.12.1) with ESMTP id fA4JJQwp000681; Sun, 4 Nov 2001 19:19:30 GMT From: "Danny Horne" To: "Ian Smith" Cc: Subject: RE: OT - Attack on Apache? Date: Sun, 4 Nov 2001 19:20:33 -0000 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300 In-Reply-To: Importance: Normal Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org > -----Original Message----- > From: owner-freebsd-security@FreeBSD.ORG > [mailto:owner-freebsd-security@FreeBSD.ORG]On Behalf Of Ian Smith > Sent: Saturday 03 November 2001 5:41pm > To: Danny Horne > Cc: freebsd-security@FreeBSD.ORG > Subject: Re: OT - Attack on Apache? > > 408 is a Request Timeout. 'The client did not produce a request within > the time that the server was prepared to wait. The client MAY repeat > the request without modifications at any later time.' > > Most likely just the source box so bogged down that it can't complete > its requests in time. I've only seen such groups of these from Windows > webserver IPs infected with Nimda, 'randomly' scanning our subnet with > HTTP requests. Only a bother, not a danger. > > Note that the first octet of the IP address is the same as yours. You > may see as many or more of these (Nimda requests in general), over time, > from IPs having the same first two octets as your own address. We did, > anyway. Walling it off from tcp 80 access, at least until it's fixed, > won't hurt :-) > Thanks Ian, I've put a blanket ban on this IP for a while To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message