2

In my nginx access.log I have plenty of request logs like this:

1.2.3.4 - - [18/Aug/2014:12:09:33 +0200] "-" 400 0 "-" "-"

As you see there is neither browser specification nor any target url. I am wondering whether they could be part of an attack scheme (what sort of?) and if so how best to counter them?

Improve this question
2
  • You mind if i see your nginx config file also Vhost file
    – BigBob1000
    Aug 19, 2014 at 4:31
  • Check what ends up in the log when you send (using telnet) a request with missing fields, or an emtpy request.
    – CL.
    Aug 19, 2014 at 8:05

1 Answer 1

Reset to default
3

That's the result of somebody sending an empty request to your server. It's not a useful attack vector by itself (as you can see from the log, your server returned a "400 Bad Request" error message), but it can be used as an "is there a webserver here?" probe.

Personally, I'd ignore it. There's a lot of automated scanning going on out there, and you could spend untold hours trying to stop things that aren't a threat in the first place.

Improve this answer
2
  • If the number of these empty requests is high, increasing, or is coming at the same time from ≠ @IP, this might be the sign of the tuning of a DOS.
    – dan
    Feb 15, 2015 at 10:40
  • 1
    @danielAzuelos, an empty request doesn't make a very good DoS. Returning an error code requires very little processing power and, for a sensibly-configured server, only marginally more bandwidth than the original request.
    – Mark
    Feb 15, 2015 at 10:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .