Server Crashed

TheMSsForum.com: The Microsoft Software Forum

My web server crashed today and given below is a snippet from the log file

2007-01-11 11:04:46 210.212.210.166 2747 192.168.168.105 80 HTTP/1.1 POST
/synergy/RGEN/rg.aspx 400 1 BadRequest DefaultAppPool
2007-01-11 11:04:46 210.212.210.166 2746 192.168.168.105 80 HTTP/1.1 POST
/synergy/RGEN/rg.aspx 400 1 BadRequest DefaultAppPool
2007-01-11 11:04:46 210.212.210.166 2748 192.168.168.105 80 HTTP/1.1 POST
/synergy/RGEN/rg.aspx 400 1 BadRequest DefaultAppPool
2007-01-11 11:04:47 210.212.210.166 2752 192.168.168.105 80 HTTP/1.1 POST
/synergy/RGEN/rg.aspx 400 1 BadRequest DefaultAppPool
2007-01-11 11:04:47 210.212.210.166 2753 192.168.168.105 80 HTTP/1.1 POST
/synergy/RGEN/rg.aspx 400 1 BadRequest DefaultAppPool
2007-01-11 11:04:47 210.212.210.166 2754 192.168.168.105 80 HTTP/1.1 POST
/synergy/RGEN/rg.aspx 400 1 BadRequest DefaultAppPool
2007-01-11 11:04:47 210.212.210.166 2755 192.168.168.105 80 HTTP/1.1 POST
/synergy/RGEN/rg.aspx 400 1 BadRequest DefaultAppPool
2007-01-11 11:05:29 210.212.210.166 2251 192.168.168.105 80 - - - - -
Timer_ConnectionIdle -
2007-01-11 11:05:29 210.212.210.166 2232 192.168.168.105 80 - - - - -
Timer_ConnectionIdle -
2007-01-11 11:05:43 210.212.210.166 2746 192.168.168.105 80 HTTP/1.1 POST
/synergy/RGEN/rg.aspx 400 1 Connection_Dropped DefaultAppPool
2007-01-11 11:05:43 210.212.210.166 2747 192.168.168.105 80 HTTP/1.1 POST
/synergy/RGEN/rg.aspx 400 1 Connection_Dropped DefaultAppPool
2007-01-11 11:05:43 210.212.210.166 2748 192.168.168.105 80 HTTP/1.1 POST
/synergy/RGEN/rg.aspx 400 1 Connection_Dropped DefaultAppPool
2007-01-11 11:05:43 210.212.210.166 2752 192.168.168.105 80 HTTP/1.1 POST
/synergy/RGEN/rg.aspx 400 1 Connection_Dropped DefaultAppPool
2007-01-11 11:05:43 210.212.210.166 2753 192.168.168.105 80 HTTP/1.1 POST
/synergy/RGEN/rg.aspx 400 1 Connection_Dropped DefaultAppPool
2007-01-11 11:05:43 210.212.210.166 2754 192.168.168.105 80 HTTP/1.1 POST
/synergy/RGEN/rg.aspx 400 1 Connection_Dropped DefaultAppPool
2007-01-11 11:05:43 210.212.210.166 2755 192.168.168.105 80 HTTP/1.1 POST
/synergy/RGEN/rg.aspx 400 1 Connection_Dropped DefaultAppPool

Looking at these entries, it looks like there are quite a few requests from
the same IP address in a matter of seconds..Does this mean that page is
getting hacked or should I look at something else?

Thanks a lot in advance
Top

Re: Server Crashed by David

David
Fri Feb 23 03:45:53 CST 2007

It does look like an attempt to send lots of malformed requests at
ASP.Net, possibly attempting to hack it, but they are all failing
right at the front door before it even gets to ASP.Net.


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//




On Feb 22, 7:59 pm, Amlan <A...@discussions.microsoft.com> wrote:
> My web server crashed today and given below is a snippet from the log file
>
> 2007-01-11 11:04:46 210.212.210.166 2747 192.168.168.105 80 HTTP/1.1 POST
> /synergy/RGEN/rg.aspx 400 1 BadRequest DefaultAppPool
> 2007-01-11 11:04:46 210.212.210.166 2746 192.168.168.105 80 HTTP/1.1 POST
> /synergy/RGEN/rg.aspx 400 1 BadRequest DefaultAppPool
> 2007-01-11 11:04:46 210.212.210.166 2748 192.168.168.105 80 HTTP/1.1 POST
> /synergy/RGEN/rg.aspx 400 1 BadRequest DefaultAppPool
> 2007-01-11 11:04:47 210.212.210.166 2752 192.168.168.105 80 HTTP/1.1 POST
> /synergy/RGEN/rg.aspx 400 1 BadRequest DefaultAppPool
> 2007-01-11 11:04:47 210.212.210.166 2753 192.168.168.105 80 HTTP/1.1 POST
> /synergy/RGEN/rg.aspx 400 1 BadRequest DefaultAppPool
> 2007-01-11 11:04:47 210.212.210.166 2754 192.168.168.105 80 HTTP/1.1 POST
> /synergy/RGEN/rg.aspx 400 1 BadRequest DefaultAppPool
> 2007-01-11 11:04:47 210.212.210.166 2755 192.168.168.105 80 HTTP/1.1 POST
> /synergy/RGEN/rg.aspx 400 1 BadRequest DefaultAppPool
> 2007-01-11 11:05:29 210.212.210.166 2251 192.168.168.105 80 - - - - -
> Timer_ConnectionIdle -
> 2007-01-11 11:05:29 210.212.210.166 2232 192.168.168.105 80 - - - - -
> Timer_ConnectionIdle -
> 2007-01-11 11:05:43 210.212.210.166 2746 192.168.168.105 80 HTTP/1.1 POST
> /synergy/RGEN/rg.aspx 400 1 Connection_Dropped DefaultAppPool
> 2007-01-11 11:05:43 210.212.210.166 2747 192.168.168.105 80 HTTP/1.1 POST
> /synergy/RGEN/rg.aspx 400 1 Connection_Dropped DefaultAppPool
> 2007-01-11 11:05:43 210.212.210.166 2748 192.168.168.105 80 HTTP/1.1 POST
> /synergy/RGEN/rg.aspx 400 1 Connection_Dropped DefaultAppPool
> 2007-01-11 11:05:43 210.212.210.166 2752 192.168.168.105 80 HTTP/1.1 POST
> /synergy/RGEN/rg.aspx 400 1 Connection_Dropped DefaultAppPool
> 2007-01-11 11:05:43 210.212.210.166 2753 192.168.168.105 80 HTTP/1.1 POST
> /synergy/RGEN/rg.aspx 400 1 Connection_Dropped DefaultAppPool
> 2007-01-11 11:05:43 210.212.210.166 2754 192.168.168.105 80 HTTP/1.1 POST
> /synergy/RGEN/rg.aspx 400 1 Connection_Dropped DefaultAppPool
> 2007-01-11 11:05:43 210.212.210.166 2755 192.168.168.105 80 HTTP/1.1 POST
> /synergy/RGEN/rg.aspx 400 1 Connection_Dropped DefaultAppPool
>
> Looking at these entries, it looks like there are quite a few requests from
> the same IP address in a matter of seconds..Does this mean that page is
> getting hacked or should I look at something else?
>
> Thanks a lot in advance

Top