0

in my previous post I got something weird in Apache log. Again, I found something strange, but what freaks me out is the response code. It's not 501 anymore, but 200. What do you say? Should I enable the paranoid-mode? Here's the entry:

***.***.***.*** - - [02/Feb/2011:00:42:51 +0100] "=\xa29)\x84\x11\xd0O\xa7@\xbd\x8f\xc4G\x96T\xf4" 200 25564
Community
  • 1
aL3xa
  • 153
  • 5

2 Answers2

3

It wasn't a valid HTTP-request. You could get similar log entry doing something like telnet youserver 80 and then Entering 'HELLO'. I guess there's some index.php at the root of your server?

poige
  • 9,448
  • 2
  • 25
  • 52
-1

If memory serves 200 is a HTTP Status code for OK

http://en.wikipedia.org/wiki/List_of_HTTP_status_codes

From wikipedia

2xx Success

This class of status codes indicates the action requested by the client was received, understood, accepted and processed successfully.

200 OK Standard response for successful HTTP requests. The actual response will depend on the request method used. In a GET request, the response will contain an entity corresponding to the requested resource. In a POST request the response will contain an entity describing or containing the result of the action.

trozz
  • 557
  • 2
  • 12
  • Yes, 200 = OK, but doesn't that mean that potentially malicious request is executed on my server? – aL3xa Feb 02 '11 at 01:07
  • I would think that this appearing in the log could be a simple misformed packet... as they do happen i dont often read my log files as close as you seem to :) (good on you tho for keep such a close eye on it) as an answer on your last post said if it woudl be more than likely that if this was a hacker that found a hole you would of been hacked well before you saw the log file. - I will however look around and see what i can find for you :) – trozz Feb 02 '11 at 01:10
  • 1
    have a look http://httpd.apache.org/docs/1.3/logs.html#common it appears to be common place for a 200 in the logs, ill have a look at my apache server once i have a chance tomorrow – trozz Feb 02 '11 at 01:12
  • I'll do that, thanx for info! – aL3xa Feb 02 '11 at 01:31