Weird browser behavior: frequent empty (bad) requests
Weird thing started to happen. As part of the security onion, I ban all IPs that try connecting to the web server (Nginx) via IP directly and not through a hostname (fail2ban regex on access.log).
Today I found out that one of the legitimate clients got banned and upon closer inspection I found this logged for his requests:
xx.xx.xx.xx - - [23/Aug/2011:17:11:01 +0000] "-" 400 0 "-" "-" "-"
(IP censored)
So I figured there must be something wrong with his browser (Firefox 3.6 on Windows), but the log is full of such entries, for various remote IPs (not just this client's I suppose), beside standard webapp sniffers. I guess this client is the first who complained.
Tried to google for it, perhaps it's a bug in FF, but I came up short. Top entries in Google suggest clearing the cache, and I'll suggest that to the client but I'm sure there are no cookies involved with the domain they're accessing (basic auth over https). I also do not know if any other browsers are "affected" since there is no UA reported.
Anyone familiar with this issue?
2 Replies
But then I saw this:
From an operational standpoint, I probably wouldn't use a fail2ban regexp like that, as it seems way too prone to false-positives. Plus, if it is something like a forum with user-generated content, all of your users could be taken out by some crazy git inserting an "image" like 
Best thing to do will be to fire up tcpdump and correlate timestamps.