Differences

This shows you the differences between two versions of the page.

--- pfsense:suricata:alerts:et_scan_internal_dummy_connection_user-agent_inbound [2021/01/15 00:51] – created peter
+++ pfsense:suricata:alerts:et_scan_internal_dummy_connection_user-agent_inbound [2021/01/15 00:53] (current) – peter
@@ Line 3: / Line 3: @@
 When the Apache HTTP Server manages its child processes, it needs a way to wake up processes that are listening for new connections.
-To do this, it sends a simple HTTP request back to itself.
+  * To do this, it sends a simple HTTP request back to itself.
+  * This request will appear in the access_log file with the remote address set to the loop-back interface (typically 127.0.0.1 or ::1 if IPv6 is configured).
+  * If you log the User-Agent string you will see the server signature followed by **(internal dummy connection)** on non-SSL servers.
+  * During certain periods you may see up to one such request for each httpd child process.
+  * These requests are perfectly normal and you do not, in general, need to worry about them.  They can simply be ignored.
-This request will appear in the access_log file with the remote address set to the loop-back interface (typically 127.0.0.1 or ::1 if IPv6 is configured).
+If however these come from outside the local network, then usually a trojin, so continue blocking.
-If you log the User-Agent string (as in the combined log format), you will see the server signature followed by **(internal dummy connection)** on non-SSL servers.
-During certain periods you may see up to one such request for each httpd child process.
-These requests are perfectly normal and you do not, in general, need to worry about them.  They can simply be ignored.
 ----