What could be using an HTTP request method of "-"

boatcoder asked:

Got an apache log entry that looks like this, actually I have a bunch of them spread out over time.

XXX.XXX.XXX.XXX - - [27/Apr/2012:14:39:52 -0500] "-" 408 - "-" "-"

It wasn’t a GET or POST, the method was “-“.

Anyone else seen requests like this? It wasn’t from the penetration tester, but I have it from LOTS of other IPs from Apr of 2012 up until and including today.

We failed it with a 408, just wondering what someone might be trying and googling for minus sign does NOT work.

My answer:

408 is Request Timeout. This means that the client connected but didn’t actually send any data for a while, and the server gave up and dropped the connection with this error. This is also why nothing else was logged; no data was actually sent from the client.

Apache’s default timeout in this case is 300 seconds (5 minutes); it is configurable, but this generally shouldn’t need to be changed.

View the full question and any other answers on Server Fault.

Creative Commons License
This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License.