LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - General (https://www.linuxquestions.org/questions/linux-general-1/)
-   -   More Apache Log Errors! (https://www.linuxquestions.org/questions/linux-general-1/more-apache-log-errors-47275/)

Crashed_Again 02-26-2003 02:51 PM
More Apache Log Errors!
 
What exactly are these two requests trying to accomplish:

www.isecom.com.ar - - [26/Feb/2003:15:46:36 -0500] "POST http://200.69.212.165:6667/ HTTP/1.0" 200 613 "-" "-"
www.isecom.com.ar - - [26/Feb/2003:15:46:36 -0500] "CONNECT 200.69.212.165:6667 HTTP/1.0" 405 316 "-" "-"

The ip address 200.69.212.165 is not related to my network at all and as for port 6667 I have no idea what that is all about.

nxny 02-26-2003 08:01 PM
6667 is the IRC port, if I remember right. Do you get these a lot? I have a vague idea that someone is trying to 'post' to the IRC server at the 200.x.x.x ip via your httpd. Now, that's just PURE speculation, cuz I dont know how successful these attempts would be if they were real . We'll have to see the whole packet (tcpdump) when this happens to make sure what my guess isn't too far fetched.

Scrapz 02-27-2003 05:21 AM
Some IRC servers do a sort of port scan on connect. If you look closely at the MOTD when you connect to the server, you might find something similar to this:
Quote:
--- - Please be aware that OFTC operates an open proxy detection
--- - system(http://www.blitzed.org/bopm). Please disregard
--- - connections from proxy-scan.oftc.net(216.86.139.17) as it
--- - is the detector in action. If you dislike this, please
--- - disconnect now.
Anything on port 6667 will most likely be the IRC proxy scans. Its nothing to be worried about, unless of course, you're not using IRC ;)


All times are GMT -5. The time now is 04:05 AM.