Re: 404 with IIS (6.0) PHP, CGI, Host Header on Windows 2003 Server

From: Bernhard (bpreiss_at_gmx.net.)
Date: 02/16/05 

Date: Tue, 15 Feb 2005 23:20:49 -0600

I have been investigating it further and took a look in HTTPERR.LOG

I found two entries:

2005-02-16 03:42:46 127.0.0.1 1490 127.0.0.1 80 HTTP/1.1 GET
/de/b2/install/index.php 400 - Hostname -
2005-02-16 03:49:11 127.0.0.1 1528 127.0.0.1 80 HTTP/1.1 GET
/de/b2/install/index.php 400 - Hostname -

All attemps for the name resoloution seem to be ok. 

-- 
Bernhard
"David Wang [Msft]" <someone@online.microsoft.com> wrote in message 
news:exc9mM9EFHA.2676@TK2MSFTNGP12.phx.gbl...
>I do not see a 404 error in you web server logs.  Are you sure you are
> actually contacting your web server.  304 is "Not Modified" meaning the
> browser is serving them from its local cache.
>
> I just do not there is an IIS issue here at all -- most likely
> DNS/networking from the looks of it.
>
> -- 
> //David
> IIS
> http://blogs.msdn.com/David.Wang
> This posting is provided "AS IS" with no warranties, and confers no 
> rights.
> //
> "Bernhard" <bpreiss@gmx.net.> wrote in message
> news:%23kuheh7EFHA.1924@TK2MSFTNGP14.phx.gbl...
> Hi David,
>
> thanks for the input - i aprechiate it!
>
>> Clearly the browser is somehow sending two different request URLs for 
>> what
>> you think is the same website, and it is likely the cause of your issue.
>> I
>> wonder if your DNS configuration only works for
>> http://blog.my-domain.info/
>> and not anything else ).
>
> Yes it works. www...., blog. ... etc can be pinged, traced and also 
> accessed
> by telnet
>>
>> To test this theory out, make sure that no website on the web server 
>> binds
>> to the default "any host header" value, and make your 404 request again.
>> It
>> will likely return 400 this time.
>
> No, still 404
> Even default pages like default.htm ending up with a 404
>
> http://blog.my-domain.info should bring up the default.htm, but it also 
> runs
> into a 404
> http://blog.my-domain.info/default.htm instead works fine.
>
> This is was the log looks like now:
>
> 10.10.2.220 GET /test.php - 80 - 68.nn.nnn.nn HTTP/1.0 - 
> www.my-domain.info
> 200 0 0
> 10.10.2.220 GET /test.php =PHPE9568F35-D428-11d2-A769-00AA001ACF42 80 -
> 68.nn.nnn.nn HTTP/1.0 http://www.my-domain.info/test.php 
> www.my-domain.info
> 200 0 0
> 10.10.2.220 GET /test.php =PHPE9568F34-D428-11d2-A769-00AA001ACF42 80 -
> 68.nn.nnn.nn HTTP/1.0 http://www.my-domain.info/test.php 
> www.my-domain.info
> 200 0 0
> 10.10.2.220 GET /pagerror.gif - 80 - 68.nn.nnn.nn HTTP/1.0
> http://blog.my-domain.info/default.htm blog.my-domain.info 200 0 0
> 10.10.2.220 GET /default.htm - 80 - 68.nn.nnn.nn HTTP/1.0 -
> blog.my-domain.info 304 0 0
> 10.10.2.220 GET /pagerror.gif - 80 - 68.nn.nnn.nn HTTP/1.0
> http://blog.my-domain.info/default.htm blog.my-domain.info 304 0 0
> 10.10.2.220 GET /pagerror.gif - 80 - 68.nn.nnn.nn HTTP/1.0
> http://www.my-domain.info/default.htm www.my-domain.info 200 0 0
> 10.10.2.220 GET /default.htm - 80 - 68.nn.nnn.nn HTTP/1.0 -
> www.my-domain.info 304 0 0
> 10.10.2.220 GET /pagerror.gif - 80 - 68.nn.nnn.nn HTTP/1.0
> http://www.my-domain.info/default.htm www.my-domain.info 304 0 0
> 10.10.2.220 GET /pagerror.gif - 80 - 68.nn.nnn.nn HTTP/1.0
> http://my-domain.info/default.htm my-domain.info 200 0 0
> 10.10.2.220 GET /default.htm - 80 - 68.nn.nnn.nn HTTP/1.0 - my-domain.info
> 304 0 0
> 10.10.2.220 GET /pagerror.gif - 80 - 68.nn.nnn.nn HTTP/1.0
> http://my-domain.info/default.htm my-domain.info 304 0 0
> 10.10.2.220 GET /default.htm - 80 - 68.nn.nnn.nn HTTP/1.0 - my-domain.info
> 304 0 0
> 10.10.2.220 GET /pagerror.gif - 80 - 68.nn.nnn.nn HTTP/1.0
> http://my-domain.info/default.htm my-domain.info 304 0 0
> 10.10.2.220 GET /default.htm - 80 - 68.nn.nnn.nn HTTP/1.0 - my-domain.info
> 304 0 0
> 10.10.2.220 GET /pagerror.gif - 80 - 68.nn.nnn.nn HTTP/1.0
> http://my-domain.info/default.htm my-domain.info 304 0 0
> 10.10.2.220 GET /default.htm - 80 - 68.nn.nnn.nn HTTP/1.0 - my-domain.info
> 304 0 0
> 10.10.2.220 GET /pagerror.gif - 80 - 68.nn.nnn.nn HTTP/1.0
> http://my-domain.info/default.htm my-domain.info 304 0 0
> 10.10.2.220 GET /default.htm - 80 - 68.nn.nnn.nn HTTP/1.0 - my-domain.info
> 304 0 0
> 10.10.2.220 GET /pagerror.gif - 80 - 68.nn.nnn.nn HTTP/1.0
> http://my-domain.info/default.htm my-domain.info 304 0 0
> 10.10.2.220 GET /default.htm - 80 - 68.nn.nnn.nn HTTP/1.0 - my-domain.info
> 304 0 0
> 10.10.2.220 GET /pagerror.gif - 80 - 68.nn.nnn.nn HTTP/1.0
> http://my-domain.info/default.htm my-domain.info 304 0 0
> 10.10.2.220 GET /default.htm - 80 - 68.nn.nnn.nn HTTP/1.0 - my-domain.info
> 200 0 0
> 10.10.2.220 GET /default.htm - 80 - 68.nn.nnn.nn HTTP/1.0 - my-domain.info
> 304 0 0
> 10.10.2.220 GET /default.htm - 80 - 68.nn.nnn.nn HTTP/1.0 - my-domain.info
> 304 0 0
> 10.10.2.220 GET /default.htm - 80 - 68.nn.nnn.nn HTTP/1.0 -
> blog.my-domain.info 200 0 0
>
> Thank you
> --
> Bernhard
>>
>> -- 
>> //David
>> IIS
>> http://blogs.msdn.com/David.Wang
>> This posting is provided "AS IS" with no warranties, and confers no
>> rights.
>> //
>> "Kristofer Gafvert" <kgafvert@NEWSilopia.com> wrote in message
>> news:xn0dyjjfz8lzjwl00b@news.microsoft.com...
>> Hmm...i was hoping to see something else but substatus code of 0. That
>> simply means that the file is not there.
>>
>> You don't have any typos in the URL, and the file is there? (i just had 
>> to
>> ask that)
>>
>> Do you have URLScan or something else installed that could affect this?
>>
>> -- 
>> Regards,
>> Kristofer Gafvert
>> www.gafvert.info - My Articles and help
>> www.ilopia.com
>>
>>
>> Bernhard wrote:
>>
>>> Thank you Kristofer,
>>>
>>> I enabled the propper logging and this is what i get now:
>>>
>>> These are the requests with the working test.php file:
>>>
>>> #Fields: date time s-sitename s-computername s-ip cs-method cs-uri-stem
>>> cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent)
>> cs(Referer)
>>> cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes
>>> 2005-02-15 18:24:25 W3SVC1167229278 MAXIMUS 10.10.2.220 GET /test.php
>>> =PHPE9568F34-D428-11d2-A769-00AA001ACF42 80 - 68.nn.nnn.nn HTTP/1.0
>>>
>> Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322)
>>> http://blog.my-domain.info/test.php blog.my-domain.info 200 0 0 3138 312
>>> 2005-02-15 18:24:25 W3SVC1167229278 MAXIMUS 10.10.2.220 GET /test.php
>>> =PHPE9568F35-D428-11d2-A769-00AA001ACF42 80 - 68.nn.nnn.nn HTTP/1.0
>>>
>> Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322)
>>> http://blog.my-domain.info/test.php blog.my-domain.info 200 0 0 4616 312
>>> 2005-02-15 18:24:27 W3SVC1167229278 MAXIMUS 10.10.2.220 GET /test.php -
>> 80 -
>>> 68.nn.nnn.nn HTTP/1.0
>>>
>> Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322)
>> -
>>> blog.my-domain.info 200 0 0 29839 227
>>> 2005-02-15 18:24:27 W3SVC1167229278 MAXIMUS 10.10.2.220 GET /test.php
>>> =PHPE9568F34-D428-11d2-A769-00AA001ACF42 80 - 68.nn.nnn.nn HTTP/1.0
>>>
>> Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322)
>>> http://blog.my-domain.info/test.php blog.my-domain.info 200 0 0 3138 312
>>> 2005-02-15 18:24:27 W3SVC1167229278 MAXIMUS 10.10.2.220 GET /test.php
>>> =PHPE9568F35-D428-11d2-A769-00AA001ACF42 80 - 68.nn.nnn.nn HTTP/1.0
>>>
>> Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322)
>>> http://blog.my-domain.info/test.php blog.my-domain.info 200 0 0 4616 312
>>> 2005-02-15 18:24:28 W3SVC1167229278 MAXIMUS 10.10.2.220 GET /test.php -
>> 80 -
>>> 68.nn.nnn.nn HTTP/1.0
>>>
>> Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322)
>> -
>>> blog.my-domain.info 200 0 0 29839 227
>>> 2005-02-15 18:24:28 W3SVC1167229278 MAXIMUS 10.10.2.220 GET /test.php
>>> =PHPE9568F34-D428-11d2-A769-00AA001ACF42 80 - 68.nn.nnn.nn HTTP/1.0
>>>
>> Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322)
>>> http://blog.my-domain.info/test.php blog.my-domain.info 200 0 0 3138 312
>>> 2005-02-15 18:24:28 W3SVC1167229278 MAXIMUS 10.10.2.220 GET /test.php
>>> =PHPE9568F35-D428-11d2-A769-00AA001ACF42 80 - 68.nn.nnn.nn HTTP/1.0
>>>
>> Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322)
>>> http://blog.my-domain.info/test.php blog.my-domain.info 200 0 0 4616 312
>>>
>>> And thats what i get when i try to access the existing test.php in a
>>> subdirectory:
>>> #Fields: date time s-sitename s-computername s-ip cs-method cs-uri-stem
>>> cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent)
>> cs(Referer)
>>> cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes
>>> 2005-02-15 18:27:38 W3SVC1167229278 MAXIMUS 10.10.2.220 GET
>>> /install/index.php - 80 - 68.nn.nnn.nn HTTP/1.0
>>>
>> Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322)
>> -
>>> blog.my-domain.info 404 0 0 212 379
>>>
>>> Does this make any sence?
>>>
>>> Thank you.
>>
>>
>
>
>

Relevant Pages

  • Re: Suspicious IIS Log entry
    ... Your firewall will allow the request ... Your IIS web server is configured to let anyone access the ... hacker is requesting that the computer access the scripts directory, ...
    (Security-Basics)
  • Re: Page Cannot Be Displayed Errors
    ... With Wfetch, I'm getting, "0x2749 (A request to send or receive ... directly on the web server, ... >> Where can I get the IIS 6.0 Resource Kit, and how do I use WFetch? ... >> I have done some additional checking in the logs. ...
    (microsoft.public.inetserver.iis)
  • Re: http handlers
    ... It appears that I am unable to sort though the IIS documentation. ... The web server has two behaviors. ... A request in the first form returns the content of the default web site ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Same page displayed when content changes
    ... it doesnt make a request to the server. ... and no entry in the web server log for IIS. ... not asking the web server if the content has changed. ... >> parameter changes, IE would reload it, because the URL is different. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Page Cannot Be Displayed Errors
    ... In WFetch, for Advanced Request, change to "Add Headers" and write: ... > directly on the web server, ... >>> Where can I get the IIS 6.0 Resource Kit, and how do I use WFetch? ...
    (microsoft.public.inetserver.iis)
Loading