[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: Odd log messages

On Sun, Dec 11, 2005 at 07:04:08PM -0500, Void Beast wrote:
> Hash: SHA256
> I keep getting this log message repeated about every 2 hours:
> Dec 11 17:30:22.339 [warn] headerlen 65623 larger than 49999. Failing.
> Dec 11 17:30:22.370 [warn] Invalid input from address ''.
> Closing.
> Perhaps a crawler of some sort has latched on to my port 80 thinking it is
> a webserver?
> I dunno... Any ideas?

That's one likeliest explanation.  Tor uses HTTP to serve directory
information, but (we think) it never sends a HTTP request bigger than
49999 bytes long.  So when it sees a very long HTTP request, it
rejects it.

That's quite a long request, though! Possibly somebody is sending
malformed HTTP, or some compromised machine is trying out exploits.
Hard to say.

Nick Mathewson

Attachment: pgpzr1LSwdpO7.pgp
Description: PGP signature