odd requests on port 80

MiCr0

Hi,
i've just jumpstarted a solaris machine - and i'm seeing these odd entries in a log

2007-02-21 23:56:40 127.0.0.1:37441 "GET /server-status?auto" 503 "Unknown host."
2007-02-21 23:57:10 127.0.0.1:37442 "GET /server-status?auto" 503 "Unknown host."
2007-02-21 23:57:15 127.0.0.1:37443 "GET /PerfTestApp/PerfServlet" 503 "Unknown host."
2007-02-21 23:57:20 127.0.0.1:37444 "GET /PerfApp/PerfServlet?username=&password=" 503 "Unknown host."
2007-02-21 23:57:40 127.0.0.1:37445 "GET /server-status?auto" 503 "Unknown host."
2007-02-21 23:58:10 127.0.0.1:37446 "GET /server-status?auto" 503 "Unknown host."
2007-02-21 23:58:15 127.0.0.1:37447 "GET /PerfTestApp/PerfServlet" 503 "Unknown host."
2007-02-21 23:58:20 127.0.0.1:37448 "GET /PerfApp/PerfServlet?username=&password=" 503 "Unknown host."
2007-02-21 23:58:41 127.0.0.1:37449 "GET /server-status?auto" 503 "Unknown host."
2007-02-21 23:59:11 127.0.0.1:37450 "GET /server-status?auto" 503 "Unknown host."
2007-02-21 23:59:15 127.0.0.1:37451 "GET /PerfTestApp/PerfServlet" 503 "Unknown host."
2007-02-21 23:59:20 127.0.0.1:37452 "GET /PerfApp/PerfServlet?username=&password=" 503 "Unknown host."
2007-02-21 23:59:41 127.0.0.1:37453 "GET /server-status?auto" 503 "Unknown host."

the log is listening on port 80.
i can't find any clue whats causing the requests. the most obvious google answer is ibm websphere - but thats not installed on the machine.

any clues/thoughts appreciated.

david

bringitdown

Well all the requests are originating from 127.0.0.1 which is the machine itself, anything strange or curious running?

Perhaps some system monitoring application is responsible as the server-status requests are to mod_status of Apache - which reports the status of the Apache server surprisingly!!

No idea what Perf* requests are. You can probably track it down using netstat or snoop.

MiCr0

yea, but as its localhost - snoop doesn't show anything

Khannie

I'm pretty sure you can make snoop show localhost ports. I think I've done it before on Solaris (though can't remember how, edit: I'm thinking you need to snoop lo0 instead of ce0). I've done it within the last week with ethereal on a linux box.

bringitdown

Linux doesn't have the problem AFAIR ... Solaris and HP/UX don't implement loopback the same way so when pcap tries to open /dev/lo0 it just doesn't work.

dtrace script that might help:

http://forum.java.sun.com/thread.jspa?threadID=5075493&tstart=105

MiCr0

problem solved
it was due to a piece of monitoring software that was checking to see if websphere was running correctly.
it wasn't installed - and so the webserver on port 80 was logging the request