| View previous topic :: View next topic |
| Author |
Message |
ericzollman
-
Joined: 30 Sep 2004
Posts: 8
Location: Indiana, USA
|
 Posted: Thu Sep 30, 2004 10:29 pm Post subject: What the HECK is this? |
 |
|
This line keeps coming up in my access log about every 5 or 6 seconds!!!!. And my server is reciving a BUNCH of bunk hits.,
218.48.165.59 - - [30/Sep/2004:17:20:52 -0700] "OPTIONS / HTTP/1.1" 403 223
What does this line mean? I don't understand it. Why does it say OPTIONS instead of saying GET like other lines., I Understand the GET lines because they also state what the user was getting... These OPTION lines are just freaky! It's got me thinking somebody is trying to either hack my site, or attack me with a DOS attack or someting., Any info would be great...
I have shut down my server untill I understand what this is and how to stop it. Please help...
_________________
-Eric Zollman
http://infinity.r8.org
http://stoic.r8.org |
|
| Back to top |
    |
 |
Foxified
-
Joined: 13 Apr 2004
Posts: 487
Location: Canada
|
| Posted: Fri Oct 01, 2004 12:23 am Post subject: Re: What the HECK is this? |
|
|
| ericzollman wrote: | This line keeps coming up in my access log about every 5 or 6 seconds!!!!. And my server is reciving a BUNCH of bunk hits.,
218.48.165.59 - - [30/Sep/2004:17:20:52 -0700] "OPTIONS / HTTP/1.1" 403 223
What does this line mean? I don't understand it. Why does it say OPTIONS instead of saying GET like other lines., I Understand the GET lines because they also state what the user was getting... These OPTION lines are just freaky! It's got me thinking somebody is trying to either hack my site, or attack me with a DOS attack or someting., Any info would be great...
I have shut down my server untill I understand what this is and how to stop it. Please help... |
perhaps, a DNS scan, about, info of the server, like what your running, etc.. im not so sure
_________________
 |
|
| Back to top |
 |
|
mg66
-
Joined: 15 Aug 2004
Posts: 85
Location: USA, Illinois
|
|
| Back to top |
|
|
ericzollman
-
Joined: 30 Sep 2004
Posts: 8
Location: Indiana, USA
|
| Posted: Fri Oct 01, 2004 7:07 am Post subject: |
|
|
Yea I was running version 1.2 when I noticed the problem. The Beta is not posted on the main site. You have to be a user of the forum to get the download from what I see... But the IP is blocked now.
_________________
-Eric Zollman
http://infinity.r8.org
http://stoic.r8.org |
|
| Back to top |
|
|
Anonymoose
-
Joined: 09 Sep 2003
Posts: 2192
|
| Posted: Fri Oct 01, 2004 9:56 am Post subject: |
|
|
| Just another IIS vulnerability scan. Not using IIS, so no need to worry... |
|
| Back to top |
|
|
TRUSTAbyss
-
Joined: 29 Oct 2003
Posts: 3752
Location: USA, GA
|
| Posted: Fri Oct 01, 2004 9:02 pm Post subject: |
|
|
You might want to actually do like a DNS lookup on your website and check
your log when your done , that could be the problem like Foxified was saying. |
|
| Back to top |
|
|
Anonymoose
-
Joined: 09 Sep 2003
Posts: 2192
|
| Posted: Fri Oct 01, 2004 11:28 pm Post subject: |
|
|
| It isn't a DNS lookup which would be on port 53 anyway, nothing to do with the HTTP protocol. The Options is an alternative to POST or GET, as I said, likely to be a vulnerability scan for either IIS and Apache. |
|
| Back to top |
|
|
TRUSTAbyss
-
Joined: 29 Oct 2003
Posts: 3752
Location: USA, GA
|
| Posted: Sat Oct 02, 2004 10:48 am Post subject: |
|
|
Aprelium should add a feature to reject the OPTIONS method if thats the
case because I never heard of that method in my life , now I know lol. |
|
| Back to top |
|
|
Anonymoose
-
Joined: 09 Sep 2003
Posts: 2192
|
| Posted: Sat Oct 02, 2004 3:18 pm Post subject: |
|
|
The OPTIONS method is defined in the RFC for HTTP :
http://www.ietf.org/rfc/rfc2068.txt
It is an optional feature to support, only POST and GET are required to comply with the HTTP standard in a server, but if it is not supported, there is no need for a reject option - you can see from the log the server is already returning 403/Forbidden... If it is totally unsupported it should be returning a 405 rather than 403 error I believe, but either way the result is the same - the request has no result or effect on the performance/security of Abyss. |
|
| Back to top |
|
|
ericzollman
-
Joined: 30 Sep 2004
Posts: 8
Location: Indiana, USA
|
| Posted: Sat Oct 02, 2004 4:34 pm Post subject: |
|
|
Thanx for the info everybody. I have upgraded to 2.0 Beta and blocked the IP. My only real concern was the performance of my server. I'm just runninf on a 4 Mbps connection, and the hits from that IP address with the OPTION line where coming in every 2 seconds for hours at a time! I thought it might just slow shit down hitting the server so much..,
Anyway thanx again for all the help.
_________________
-Eric Zollman
http://infinity.r8.org
http://stoic.r8.org |
|
| Back to top |
|
|
|
