400 bad request errors

Server NGINX
1

hi

i have several errors in my access_log

IP _ - [28/Sep/2009:15:56:33 +0200] “-” 400 0 “-” “-” “-”

why these errors occur?

thanks!!!

Posted at Nginx Forum:

2

Hello!

On Mon, Sep 28, 2009 at 10:07:25AM -0400, pepejose wrote:

hi

i have several errors in my access_log

IP _ - [28/Sep/2009:15:56:33 +0200] “-” 400 0 “-” “-” “-”

why these errors occur?

These errors are “400 Bad Request”, most likely just client
connects without sending anything. Some load balancers / health
checks known to cause a lots of these.

Maxim D.

3

I’ve been getting plenty of these too, and all originating from
different
IPs in my ISP. Think the load balancer possibility doesn’t really
answer
for my case. Does anyone else have any other answers on this?
Ray

4

I have to worry about? Logwatch says A total of XXX sites probed the
server and
if I look at those ip access log I see Error 400

thank you very much!

Posted at Nginx Forum:

5

Hello!

On Mon, Sep 28, 2009 at 10:44:26AM -0400, pepejose wrote:

I have to worry about? Logwatch says A total of XXX sites probed the server and
if I look at those ip access log I see Error 400

No, there is nothing to worry about. Such errors are more or less
normal, they will happen eventually under normal load.

Big percent of such errors may indicate network problems, but
you’ll probably notice it from other (and more reliable)
information sources as well.

Maxim D.

6

hello again! jeje

well, I’ve been watching the logs again and the report of Logwatch, now
with nginx as reverse proxy in front of apache I have in one hour 441
“NULL 400 Bad Requests” made by 45 ips aprox

example:

17 connections: same ip, same second

IP _ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-” “-” “-”
IP _ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-” “-” “-”
IP _ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-” “-” “-”
IP _ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-” “-” “-”
IP _ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-” “-” “-”
IP _ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-” “-” “-”
IP _ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-” “-” “-”
IP _ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-” “-” “-”
IP _ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-” “-” “-”
IP _ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-” “-” “-”
IP _ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-” “-” “-”
IP _ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-” “-” “-”
IP _ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-” “-” “-”
IP _ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-” “-” “-”
IP _ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-” “-” “-”
IP _ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-” “-” “-”
IP _ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-” “-” “-”

These amounts are normal with nginx?
how can I know the causes of this?
What can I do?

thanks!! thanks!! thanks!!

Posted at Nginx Forum:

7

Maxim D. Wrote:

are more or less
normal, they will happen eventually under normal
load.

Big percent of such errors may indicate network
problems, but
you’ll probably notice it from other (and more
reliable)
information sources as well.

Maxim D.

ok! thanks!!

Posted at Nginx Forum:

8

pepejose Wrote:

IP _ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-”
“-” “-”
IP _ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-”
“-” “-”

These amounts are normal with nginx?
how can I know the causes of this?
What can I do?

thanks!! thanks!! thanks!!

I’ve been looking at the error.log

this is the type of error that causes these entries in the access.log

2009/10/05 18:26:12 31810#0: *29604 client closed prematurely
connection while reading client request line, client: IP, server: _

in my configuration file I have the following virtualhost:

server {

listen *:80;
server_name _; #default
return 444;
}

then, why a request without host header generating a response 400 (bad
request) and not a 444 as in the case if there is the host header but
there is no virtualhost defined with same host?

thanks!!!

Posted at Nginx Forum:

9

telnet ip port

access.log

MyIP _ - [06/Oct/2009:16:46:06 +0200] “\x03” 400 166 “-” “-” “-”

error.log

2009/10/06 16:46:06 5452#0: *524221 client sent invalid method while
reading client request line, client: MyIP, server: _, request: “”

thanks for your help!

Posted at Nginx Forum:

10

On Tue, Oct 06, 2009 at 10:19:04AM -0400, pepejose wrote:

IP _ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-”
“-” “-”
IP _ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-”

listen *:80;
server_name _; #default
return 444;
}

then, why a request without host header generating a response 400 (bad request) and not a 444 as in the case if there is the host header but there is no virtualhost defined with same host?

Do the following:

telnet you.host 80
^D

or

telnet you.host 80
^]
quit

then look in logs.

11

pepejose Wrote:

invalid method while reading client request line,
client: MyIP, server: _, request: “”

thanks for your help!

sorry, I forgot ^ D

here is

access.log

MyIP _ - [06/Oct/2009:17:03:31 +0200] “^” 400 166 “-” “-” “-”

error.log

2009/10/06 17:03:31 5452#0: *537681 client sent invalid method while
reading client request line, client: MyIP, server: _, request: “^”

Posted at Nginx Forum:

12

On Tue, Oct 06, 2009 at 10:56:20AM -0400, pepejose wrote:

thanks for your help!
I meant "Ctrl-D and Ctrl-] in “^D” and “^]”.

Anyway, these bad requests are caused 400 error much early than “return
444”.

13

Igor Sysoev
then,

in the wiki says this

“The basic name of server is used in an HTTP redirects, if no Host
header was in client request or that header does not match any assigned
server_name”

the response is HTTP 444 if there is the host header but there is no
virtualhost defined with same host
but 400 bad request when no header host in request, however, the sever
field equals “_” and not empty

all this because every day I have many entries in the access.log like
this and want to find out why:

“-” “-”
IP _ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-”
“-” “-”
IP _ - [01/Oct/2009:09:44:40 +0200] “-” 400 0 “-”
etc …

Posted at Nginx Forum:

14

On Tue, Oct 06, 2009 at 11:53:19AM -0400, pepejose wrote:

Igor Sysoev

then,

in the wiki says this

“The basic name of server is used in an HTTP redirects, if no Host header was in client request or that header does not match any assigned server_name”

the response is HTTP 444 if there is the host header but there is no virtualhost defined with same host
but 400 bad request when no header host in request, however, the sever field equals “_” and not empty

If nginx gets empty request (no any symbol at all) and does not even try
to search virtualhost, etc. It just returns 400.

all this because every day I have many entries in the access.log like this and want to find out why:

I’ve shown the ways to emulate such requests:
“telnet host 80”, then press Ctrl-D.
It may be some scanners. It may be browser that has started an images
download and has stopped the connection, because user has clicked on a
link.

15

It may be browser that has started an images
download and has stopped the connection, because user has clicked on a link.

I thought that in this case, the response was HTTP 499 [
NGINX_HTTP_CLIENT_CLOSED_REQUEST ]

with this in the configuration file, the behavior would be the same?

server {
server_name “”;
return 444;
}

thanks.

Posted at Nginx Forum:

16

On Wed, Oct 07, 2009 at 10:57:57AM -0400, pepejose wrote:

I use nginx 0.7.61 (with patch to fix VU#180065)

I read this in the wiki

<< Since nginx 0.7.12, an empty server name is supported, to catch the requests without “Host” header. >>

however, I get this error “the first server name must not be empty” then I can not catch these requests

You may set

     server_name  _  "";

“_” is just unexistant name.

17

I use nginx 0.7.61 (with patch to fix VU#180065)

I read this in the wiki

<< Since nginx 0.7.12, an empty server name is supported, to catch the
requests without “Host” header. >>

however, I get this error “the first server name must not be empty”
then I can not catch these requests

thanks

Posted at Nginx Forum:

18

everything is now working verysmoothly now…thanks for the great help
you gave…
thanks

Posted at Nginx Forum:

19

cdan18po Wrote:

everything is now working verysmoothly
now…thanks for the great help you gave…
thanks

WTF?!

with this:

server {

listen *:80;
server_name _ “”; #default
return 444;
}

and “telnet host port” + “Ctrl-D”

I can not catch requests without host header

I also read this thread which speaks about
http://marc.info/?l=nginx&m=121991334206140&w=2

thanks!!

Posted at Nginx Forum:

20

On Thu, Oct 08, 2009 at 09:59:51AM -0400, pepejose wrote:

server {

listen *:80;
server_name _ “”; #default
return 444;
}

and “telnet host port” + “Ctrl-D”

I can not catch requests without host header

I also read this thread which speaks about 'Empty server name argument - Can't get it to work' - MARC

‘server_name _ “”;’ does not make the server default.
You have to set default server for listen pair:

 server {
  • listen *:80;
  • listen *:80 default;
    server_name _ “”;
    return 444;
    }

However, if nginx has got empty request it will not run “return 444”,
you will see 400 in access_log.