2

In my nginx access.log I have plenty of request logs like this:

1.2.3.4 - - [18/Aug/2014:12:09:33 +0200] "-" 400 0 "-" "-"

As you see there is neither browser specification nor any target url. I am wondering whether they could be part of an attack scheme (what sort of?) and if so how best to counter them?

  • You mind if i see your nginx config file also Vhost file – BigBob1000 Aug 19 '14 at 4:31
  • Check what ends up in the log when you send (using telnet) a request with missing fields, or an emtpy request. – CL. Aug 19 '14 at 8:05
3

That's the result of somebody sending an empty request to your server. It's not a useful attack vector by itself (as you can see from the log, your server returned a "400 Bad Request" error message), but it can be used as an "is there a webserver here?" probe.

Personally, I'd ignore it. There's a lot of automated scanning going on out there, and you could spend untold hours trying to stop things that aren't a threat in the first place.

  • If the number of these empty requests is high, increasing, or is coming at the same time from ≠ @IP, this might be the sign of the tuning of a DOS. – daniel Azuelos Feb 15 '15 at 10:40
  • 1
    @danielAzuelos, an empty request doesn't make a very good DoS. Returning an error code requires very little processing power and, for a sensibly-configured server, only marginally more bandwidth than the original request. – Mark Feb 15 '15 at 10:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.