apache lots of GET logs. is this ok?

packets · 12-04-2016, 08:25 PM

I am seeing lots of GET on my apache logs. I am not sure if this is ok. Should I worry about this?

Code:

192.168.1.12 - - [05/Dec/2016:10:22:23 +0800] "GET /g20161584-bstsux-zgdg-lhbjw-cepu-dxgs-vdwco-uukpfs-b43909-chnk-vhns/ HTTP/1.1" 404 232461
192.168.1.12 - - [05/Dec/2016:10:22:39 +0800] "GET /ywwkh-yiccjf-pxhyzi-g20161587-qzoyblpl/lbvf-oxwxpb-ewzyo-b36412-hutnugah-swabvlvl.cgi HTTP/1.1" 404 232461
192.168.2.12 - - [05/Dec/2016:10:22:57 +0800] "GET /b1410-kfbbcrrq-stodh/g20161582-bjdrmyf-vyecbi-ujkdpvih/ HTTP/1.1" 404 232461
192.168.2.12 - - [05/Dec/2016:10:23:14 +0800] "GET /nmpjnq-dsuhnjqk-hhaevmej-mjnvsx-andgqrg-qabilavx-ajfcb-b34261-oxwsqf-g20161583-ekhhma/ HTTP/1.1" 404 232461
192.168.2.12 - - [05/Dec/2016:10:23:33 +0800] "GET /jpsdal-gtek-knkyl-othf-goed-zrgye-ixyrdj-ikdn-rtvf-g20161589-b38609-pepuvc/ HTTP/1.1" 404 232461

sundialsvcs · 12-04-2016, 08:42 PM

Why would this traffic be coming, apparently, from inside your local network, at 192.168.1.12 or 192.168.2.12?

After all, "192.168.0.0/16" is a non-routable, internal only network address. It would superficially seem that this traffic is not coming from the Internet.

Obviously, there is something funny going on here.

packets · 12-04-2016, 08:48 PM

I have a load balancer and that IP is local. That explains the local ips.

Turbocapitalist · 12-05-2016, 01:10 AM

Quote:

Originally Posted by packets

I have a load balancer and that IP is local. That explains the local ips.

There are two Apache modules that can adjust the headers so that your logs can show the external IP number instead of that of the proxy / load balancer. They are mod_remoteip and mod_rpaf. One does more, but both do the job.