localhost.customs or localhost:1001

Well, just recently I discovered an error in my Apache2 log file saying:

127.0.0.1 – – [17/Sep/2007:20:10:32 +0200] “GET /” 400 466

Well, that is a SSL log, so I am working to figure out what it really is…

Ok, “tshark -i lo -S -V > dump.shark” command comes in handy to see the packets, and here is what we get:

Internet Protocol, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)
Version: 4
<cut>
Source: 127.0.0.1 (127.0.0.1)
Destination: 127.0.0.1 (127.0.0.1)
Transmission Control Protocol, Src Port: 53612 (53612), Dst Port: customs (1001), Seq: 1, Ack: 1, Len: 155
Source port: 53612 (53612)
Destination port: customs (1001)
Sequence number: 1 (relative sequence number)
[Next sequence number: 156 (relative sequence number)]
Acknowledgement number: 1 (relative ack number)
Header length: 32 bytes
Flags: 0x18 (PSH, ACK)
0… …. = Congestion Window Reduced (CWR): Not set
.0.. …. = ECN-Echo: Not set
..0. …. = Urgent: Not set
…1 …. = Acknowledgment: Set
…. 1… = Push: Set
…. .0.. = Reset: Not set
…. ..0. = Syn: Not set
…. …0 = Fin: Not set
Window size: 32800 (scaled)
Checksum: 0xfec3 [incorrect, should be 0x14e9 (maybe caused by checksum offloading?)]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 289375346, TSecr 289375346
Data (155 bytes)0000 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 30 0d 0a GET / HTTP/1.0..
0070 28 69 6e 74 (int
0080 65 72 6e 61 6c 20 64 75 6d 6d 79 20 63 6f 6e 6e ernal dummy conn
0090 65 63 74 69 6f 6e 29 0d 0a 0d 0a ection)….

Looks like a known error of dummy connections, but a bit different one, since Apache2 didn’t speak SSL to its SSL server, so no proper “GET” request has been logged – just info about the 400 error.

The way I fixed it was to to increase the number of “MaxSpareServers” to “10” in my Apache2 configuration file. I don’t need more…

This entry was posted in Linux. Bookmark the permalink.

Leave a Reply

Your email address will not be published. Required fields are marked *