[tlug] Strange httpd and TCP/135 logs...

[Bruno Raoult <br@example.com>]

Hi,

Since Aug 18th, my apache logs show a huge number of requests, coming from different IPs,
and always asking the home page (but not the images inside).

They look like this:

219.139.36.113 - - [28/Aug/2003:20:35:03 +0900] "GET / HTTP/1.1" 200 12461 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)"
202.205.169.35 - - [28/Aug/2003:20:35:33 +0900] "GET / HTTP/1.1" 200 2180 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)"
68.155.196.72 - - [28/Aug/2003:20:36:05 +0900] "GET / HTTP/1.1" 200 12301 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)"
24.175.241.135 - - [28/Aug/2003:20:36:15 +0900] "GET / HTTP/1.1" 200 2180 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)"

At the same moment, my router filter logs show a huge number of requests on all my IP addresses on both ports 80 & 135. But I cannot find any link between the source addresses (some addresses scan port 80, and others port 135).
You will also notice that the number of bytes returned are not constant (but my home page is!). All "normal" requests return the same number of bytes, of course...

To give you an idea of the number of requests, here are some stats (don't laugh about the values before Aug 18th, this is my personal server after all, and I was already proud of these visits ;-) Today, I can be very proud, except that the requests are all of the same type as explained before :-(

date                 visits   pages hits     bandwidth
12 Aug 2003	46	66	644	5.43 MB
13 Aug 2003	49	76	876	6.45 MB
14 Aug 2003	48	198	697	8.87 MB
15 Aug 2003	38	55	586	4.96 MB
16 Aug 2003	18	48	201	1.72 MB
17 Aug 2003	48	116	621	6.16 MB
18 Aug 2003	302	346	1151	8.58 MB
19 Aug 2003	985	1025	1748	13.59 MB
20 Aug 2003	1269	1336	1836	11.58 MB
21 Aug 2003	1471	1554	2571	15.55 MB
22 Aug 2003	1547	1573	2287	14.01 MB
23 Aug 2003	1696	1744	2408	15.09 MB
24 Aug 2003	1609	1663	2260	12.02 MB
25 Aug 2003	1692	1747	2609	15.01 MB
26 Aug 2003	2022	2082	3222	18.17 MB
27 Aug 2003	2003	2053	2872	17.55 MB
28 Aug 2003	1587	1713	2188	13.08 MB

My questions:
Did you experience this yourself?
Do you have an idea of what it could be?

Thanks,

br.

-- 
GPG Key: 653514E5 (http://www.raoult.com/gpg)
--
Sorry. I forget what I was going to say.
   -- /.

Attachment: pgp00067.pgp
Description: PGP signature