Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So I'm working from a local cafe, doing some web development, and need to see something in my Apache's access log. And to my surprise, in the log I see, every 30 seconds or so, a request for my root web page, coming from -- the cafe's Verizon router.

Is this a normal or known behavior? Or is it Bad?

The web server is running on my laptop, which is physically in the cafe with me. The server is supposedly private -- there's no public website or public IP address. I just use it for testing and development. I can't think of any well-intentioned reason for someone, let alone some bot running on, or via, a wi-fi router, to be asking for /index.html every 30 seconds. Or is every public wi-fi hotspot router asking every end-user for access to port 80?

share|improve this question

closed as unclear what you're asking by TildalWave, Scott Pack, Adi, Terry Chia, tylerl Dec 20 '13 at 8:16

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

Where is this web server hosted? Locally, or on a remote network? – Steve Dec 20 '13 at 0:17
In this a test web server deployed on your machine? and is probably a gateway address for the cafe's network – Ali Ahmad Dec 20 '13 at 7:53
When I work from the cafe, my apache log shows lines like this: "",20140110130115,200,"-","text/html", "/index.html","-","-" about every 30-60 seconds. This strikes me as rather strange -- does this look like a probe of some kind, or is it perfectly normal and nothing to worry about? I'm not sure how to be more clear. – jimmy_joyce Jan 10 '14 at 20:24
@Ali Not sure what that means, sorry -- are the requests coming from the router? Or are you suggesting they have a different origin? The web server is running on my machine. – jimmy_joyce Jan 10 '14 at 20:30
@tylerl question edited, hopefully makes it more clear. – jimmy_joyce Jan 13 '14 at 22:15