Undesirable HTTP requests

From: golem (noone_at_likes.spam)
Date: 09/19/04


Date: Sun, 19 Sep 2004 20:14:48 +0200

Hi!
I have apache server running on my linux box. After few days since I had
started it, I noticed that the network bandwith is very poor. I didn't
know what was going on, so I issued a few commands and gathered some
information:

1) "netstat | grep serwerek:http" said:
tcp 1 1646 serwerek:http host28-16.pool8011:3875 CLOSING
tcp 1 13140 serwerek:http c125136.tctv.ne.jp:1322 CLOSE_WAIT
tcp 0 6181 serwerek:http 222.77.17.194:40282 FIN_WAIT1
tcp 0 0 serwerek:http 62.168.109.164:47333 ESTABLISHED
tcp 1 10880 serwerek:http 219.140.87.237:1490 CLOSE_WAIT
tcp 1 0 serwerek:http ip68-1-214-128.dl.:4915 CLOSE_WAIT
tcp 0 0 serwerek:http 62.168.109.164:46501 ESTABLISHED
[about 150 similar lines]
...

2) "apachectl extendedstatus" said:
133 requests currently being processed, 17 idle workers
_WRRRWRWRRWWRWWRWR_RRWWW_WRWRWWR_WWRWRWRWWRWRCRWWWRWRRRWRRRWWRWC
WRRWWWW_WR_RWWWWRWWWCRWWRWWWWWWW_RWRRWWWWRWRR_WRWWWWRRWRW_WWRW_W
RR_WWR_WRW_RR_WC_W_WW_..........................................

3) and now, something really fun - a part of apache "access_log" file:
210.249.10.53 - - [19/Sep/2004:21:09:42 +0200] "GET
http://ad.jp.ap.valuecommerce.com/servlet/gifbanner?sid=2134667&pid=871650184
HTTP/1.1" 302 97 "http://www.pakalolo.net/pvrank/html/index.html"
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Q312461)"
172.183.26.99 - - [19/Sep/2004:21:09:53 +0200] "GET
http://members.chloejones.com/ HTTP/1.0" 302 297
"http://members.chloejones.com:80" "Mozilla/4.7 (compatible; MSIE 5.01;
Windows NT4.0; win9x/NT 4.90 )"
[many similar lines... http adresses seems to be random]

The size of access_log is over 350 MB!! It was created a few days ago.

My question is - how could it be, that my web server receives so many
http requests (which are not valid for my host)?

thx4help in advance

-- 
golem