[42670] in North American Network Operators' Group
Re: Pattern matching odd HTTP request
daemon@ATHENA.MIT.EDU (Jake Khuon)
Tue Sep 18 18:30:23 2001
Message-Id: <200109182219.f8IMJ1Um014020@Espresso.NEEBU.Net>
From: "Jake Khuon" <khuon@gblx.net>
To: mike@biggorilla.com
Cc: Bill McGonigle <mcgonigle@medicalmedia.com>,
Jake Khuon <khuon@gblx.net>, nanog@merit.edu
In-reply-to: 's message of Tue, 18 Sep 2001 17:03:44 -0500.
<20010918170344.B22406@biggorilla.com>
Reply-To: khuon@gblx.net (Jake Khuon)
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Date: Tue, 18 Sep 2001 15:18:10 -0700
Errors-To: owner-nanog-outgoing@merit.edu
### On Tue, 18 Sep 2001 17:03:44 -0500, mike@biggorilla.com casually decided
### to expound upon Bill McGonigle <mcgonigle@medicalmedia.com> the
### following thoughts about "Re: Pattern matching odd HTTP request":
m> * Bill McGonigle (mcgonigle@medicalmedia.com) [09/18/01 15:43]:
m> >
m> >
m> > On Tuesday, September 18, 2001, at 02:36 PM, Jake Khuon wrote:
m> > >
m> > > Anyone seeing a lot of these in their webserver logs?
m> > >
m> > > 208.202.180.4 - - [18/Sep/2001:11:19:31 -0700] "-" 408 -
m> >
m> > This machine is in my /8
m> >
m> > -----
m> > 207.202.84.209 - - [18/Sep/2001:15:16:48 -0400] "-" 408 -
m> > 207.202.84.209 - - [18/Sep/2001:15:18:18 -0400] "-" 408 -
m> > 207.202.84.209 - - [18/Sep/2001:15:19:48 -0400] "-" 408 -
m>
m> Doesn't seem new...
m>
m> 195.188.192.18 - - [13/Sep/1999:02:23:43 -0500] "-" 408 - "-" "-"
m> 195.188.192.18 - - [14/Sep/1999:02:18:54 -0500] "-" 408 - "-" "-"
m>
m> But just a little more increased.
Yeah. I was trying to figure out a way to match it in my NBAR filters but I
can't seem to find a pattern that works.
--
/*====================[ Jake Khuon <khuon@GBLX.Net> ]======================+
| Chief Global Data Network Management Architect /~_ |_ () |3 /-\ |_ |
| VOX: +1 (425) 391-2262 Fax: +1 (425) 391-6772 \_| C R O S S I N G |
+=============[ 900 4th. Ave., Floor 12, Seattle, WA 98164 ]=============*/
