Strange request (possibly hex characters) in my "access_log" file

[Spab23]

I have a very strange entry in my "access_log" file. Does anyone know what they mean? The request is being caused by someone in my office who is clicking a link which should result in a usual "GET" request. Instead it is doing this:

[28/Nov/2003:15:24:45 -0800] "\x80j\x01\x03\x01" 501 -

I've tried doing a Google search on those characters without any luck and to me, they look like escaped hex characters. The first one is outside the range of ASCII characters (00-7F).

Does anyone know what this means? I also saw a similar entry that read:

[28/Nov/2003:15:24:10 -0800] "\x80F\x01\x03" 501 -

...but it only appeared once in my acces_log whereas the first message appeared several times.

Any info would be appreciated!! Thanks!

 

[Spab23]

Oh, I forgot to mention that I am running IBM HTTP Server (which is powered by Apache) on an IBM p630 running AIX 5.2.

 

[Wullie]

Hi mate,

Do you have SSL on this machine?

That entry looks like a request trying to talk SSL on a non-SSL connection.

Hope this helps

Wullie

http://www.tutorial-world.com

http://www.freshlookdesign.co.uk

http://www.necomputers.org.uk

The pessimist complains about the wind. The optimist expects it to change.
The leader adjusts the sails. - John Maxwell

 

[Spab23]

Yes, I do have SSL on this machine and I have a cert I bought from Soltrus (aka VeriSign) registered to it. The person was accessing a link using https from both IE6 and Netscape 7. Other people in my office were clicking on the same link and getting normal response.

And - here's the weirdest part: The person producing the weird errors above tried logging on to a different PC and it worked. They logged back onto their original machine and it started working.

I am stumped. Luckily the errors have stopped, but I would like to know what caused them!

 

[mrmac228]

I had a similar problem

[28/Nov/2003:09:33:27 +0000] "\x80C\x01\x03" 403 - "-" "-"

but this was down to a problem where although the page requested existed, it wasn't served because of a misconfiguration in the httpd.conf (missing <Location> </location>)

I love deadlines. I like the whooshing sound they make as they fly by - Douglas Adams