<?xml version="1.0" encoding="UTF-8"?>
<?xml-stylesheet type="text/xsl" media="screen" href="/~d/styles/rss2full.xsl"?><?xml-stylesheet type="text/css" media="screen" href="http://feeds.feedburner.com/~d/styles/itemcontent.css"?><rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:sy="http://purl.org/rss/1.0/modules/syndication/" xmlns:feedburner="http://rssnamespace.org/feedburner/ext/1.0" version="2.0">
<channel>
	<title>Comments for [blog.rayfoo]</title>
	
	<link>http://blog.rayfoo.info</link>
	<description>Infosec, DFIR, tech geekery, thoughts and whatnot</description>
	<lastBuildDate>Thu, 17 Nov 2011 18:42:56 +0000</lastBuildDate>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
		<atom10:link xmlns:atom10="http://www.w3.org/2005/Atom" rel="self" type="application/rss+xml" href="http://feeds.feedburner.com/rayfoo-blogcomments" /><feedburner:info uri="rayfoo-blogcomments" /><atom10:link xmlns:atom10="http://www.w3.org/2005/Atom" rel="hub" href="http://pubsubhubbub.appspot.com/" /><item>
		<title>Comment on Weird web server access log entries by Wilo</title>
		<link>http://feedproxy.google.com/~r/rayfoo-blogcomments/~3/KjL95vltHV0/comment-page-1</link>
		<dc:creator>Wilo</dc:creator>
		<pubDate>Thu, 17 Nov 2011 18:42:56 +0000</pubDate>
		<guid isPermaLink="false">http://blog.rayfoo.info/?p=223#comment-2170</guid>
		<description>Thanks ray, that's helpful to know.  The SO question in question (if you see what I mean) is here: http://stackoverflow.com/questions/7334193/nginx-reverse-proxy-many-html-status-code-400-responses-why .  Now that I look at it, I realise I made an assumption that it was "yours" on account of it linking to this page for more info.  Apologies if that's incorrect.</description>
		<content:encoded><![CDATA[<p>Thanks ray, that&#8217;s helpful to know.  The SO question in question (if you see what I mean) is here: <a href="http://stackoverflow.com/questions/7334193/nginx-reverse-proxy-many-html-status-code-400-responses-why" rel="nofollow">http://stackoverflow.com/questions/7334193/nginx-reverse-proxy-many-html-status-code-400-responses-why</a> .  Now that I look at it, I realise I made an assumption that it was &#8220;yours&#8221; on account of it linking to this page for more info.  Apologies if that&#8217;s incorrect.</p>
<img src="http://feeds.feedburner.com/~r/rayfoo-blogcomments/~4/KjL95vltHV0" height="1" width="1"/>]]></content:encoded>
	<feedburner:origLink>http://blog.rayfoo.info/2009/10/weird-web-server-access-log-entries/comment-page-1#comment-2170</feedburner:origLink></item>
	<item>
		<title>Comment on Weird web server access log entries by ray</title>
		<link>http://feedproxy.google.com/~r/rayfoo-blogcomments/~3/UI6gHhJKQ1M/comment-page-1</link>
		<dc:creator>ray</dc:creator>
		<pubDate>Thu, 17 Nov 2011 15:57:36 +0000</pubDate>
		<guid isPermaLink="false">http://blog.rayfoo.info/?p=223#comment-2169</guid>
		<description>Hi Wilo, yes I did find out (after reading around quite a bit) what was causing such access log entries.

Such access log entries mostly appear due to browsers trying to speed up web browsing by initiating/maintaining a connection to the web server in question for a certain time period even when there is no clicking going on.  It would occur roughly around the time frame where there was browser activity to the/your site.

This was such an old post!  Could you link to my SO question post here?  I'm curious :)</description>
		<content:encoded><![CDATA[<p>Hi Wilo, yes I did find out (after reading around quite a bit) what was causing such access log entries.</p>
<p>Such access log entries mostly appear due to browsers trying to speed up web browsing by initiating/maintaining a connection to the web server in question for a certain time period even when there is no clicking going on.  It would occur roughly around the time frame where there was browser activity to the/your site.</p>
<p>This was such an old post!  Could you link to my SO question post here?  I&#8217;m curious <img src='http://blog.rayfoo.info/wp-includes/images/smilies/icon_smile.gif' alt=':)' class='wp-smiley' /> </p>
<img src="http://feeds.feedburner.com/~r/rayfoo-blogcomments/~4/UI6gHhJKQ1M" height="1" width="1"/>]]></content:encoded>
	<feedburner:origLink>http://blog.rayfoo.info/2009/10/weird-web-server-access-log-entries/comment-page-1#comment-2169</feedburner:origLink></item>
	<item>
		<title>Comment on Weird web server access log entries by Wilo</title>
		<link>http://feedproxy.google.com/~r/rayfoo-blogcomments/~3/55p_Mpgj_CY/comment-page-1</link>
		<dc:creator>Wilo</dc:creator>
		<pubDate>Thu, 17 Nov 2011 07:43:16 +0000</pubDate>
		<guid isPermaLink="false">http://blog.rayfoo.info/?p=223#comment-2159</guid>
		<description>Hi -- I came here from your StackOverflow question on this topic.  I too have an Nginx reverse proxy with access logs showing lots of records like this.  Mine are not against any particular domain -- in fact the logs suggest these failed connections only happen when no domain is specified.  My own workstation seems to have generated many of them.  They don't seem to be causing any problem for me, but I sure am curious to know what's going on.  Did you ever find out?</description>
		<content:encoded><![CDATA[<p>Hi &#8212; I came here from your StackOverflow question on this topic.  I too have an Nginx reverse proxy with access logs showing lots of records like this.  Mine are not against any particular domain &#8212; in fact the logs suggest these failed connections only happen when no domain is specified.  My own workstation seems to have generated many of them.  They don&#8217;t seem to be causing any problem for me, but I sure am curious to know what&#8217;s going on.  Did you ever find out?</p>
<img src="http://feeds.feedburner.com/~r/rayfoo-blogcomments/~4/55p_Mpgj_CY" height="1" width="1"/>]]></content:encoded>
	<feedburner:origLink>http://blog.rayfoo.info/2009/10/weird-web-server-access-log-entries/comment-page-1#comment-2159</feedburner:origLink></item>
	<item>
		<title>Comment on Fun with Splunk: SSHD by ray</title>
		<link>http://feedproxy.google.com/~r/rayfoo-blogcomments/~3/W0NYX-VyU4o/comment-page-1</link>
		<dc:creator>ray</dc:creator>
		<pubDate>Fri, 08 Jul 2011 17:14:52 +0000</pubDate>
		<guid isPermaLink="false">http://blog.rayfoo.info/?p=489#comment-954</guid>
		<description>I've yet to try my hand at creating apps, so I can't really tell yet :)

Splunk has resources on that, have you tried taking a look there first?
&lt;a href="http://www.splunk.com/wiki/Apps:How_applications_work" rel="nofollow"&gt;http://www.splunk.com/wiki/Apps:How_applications_work&lt;/a&gt;
&lt;a href="http://www.splunk.com/wiki/Community:Creating_your_first_application" rel="nofollow"&gt;http://www.splunk.com/wiki/Community:Creating_your_first_application&lt;/a&gt;</description>
		<content:encoded><![CDATA[<p>I&#8217;ve yet to try my hand at creating apps, so I can&#8217;t really tell yet <img src='http://blog.rayfoo.info/wp-includes/images/smilies/icon_smile.gif' alt=':)' class='wp-smiley' /> </p>
<p>Splunk has resources on that, have you tried taking a look there first?<br />
<a href="http://www.splunk.com/wiki/Apps:How_applications_work" rel="nofollow">http://www.splunk.com/wiki/Apps:How_applications_work</a><br />
<a href="http://www.splunk.com/wiki/Community:Creating_your_first_application" rel="nofollow">http://www.splunk.com/wiki/Community:Creating_your_first_application</a></p>
<img src="http://feeds.feedburner.com/~r/rayfoo-blogcomments/~4/W0NYX-VyU4o" height="1" width="1"/>]]></content:encoded>
	<feedburner:origLink>http://blog.rayfoo.info/2010/03/fun-with-splunk-sshd/comment-page-1#comment-954</feedburner:origLink></item>
	<item>
		<title>Comment on Fun with Splunk: SSHD by Rob</title>
		<link>http://feedproxy.google.com/~r/rayfoo-blogcomments/~3/bfprBWYMTKU/comment-page-1</link>
		<dc:creator>Rob</dc:creator>
		<pubDate>Tue, 05 Jul 2011 21:51:28 +0000</pubDate>
		<guid isPermaLink="false">http://blog.rayfoo.info/?p=489#comment-940</guid>
		<description>this is cool , but how can I create an app out of this ssh attack so that the app will show me these attacks and may be some Dos attacks etc</description>
		<content:encoded><![CDATA[<p>this is cool , but how can I create an app out of this ssh attack so that the app will show me these attacks and may be some Dos attacks etc</p>
<img src="http://feeds.feedburner.com/~r/rayfoo-blogcomments/~4/bfprBWYMTKU" height="1" width="1"/>]]></content:encoded>
	<feedburner:origLink>http://blog.rayfoo.info/2010/03/fun-with-splunk-sshd/comment-page-1#comment-940</feedburner:origLink></item>
	<item>
		<title>Comment on BTPC’s AmazinGrace by ray</title>
		<link>http://feedproxy.google.com/~r/rayfoo-blogcomments/~3/_nid3dtaiXk/comment-page-1</link>
		<dc:creator>ray</dc:creator>
		<pubDate>Fri, 27 May 2011 16:01:03 +0000</pubDate>
		<guid isPermaLink="false">http://blog.rayfoo.info/?p=846#comment-695</guid>
		<description>Nope, awareness programme</description>
		<content:encoded><![CDATA[<p>Nope, awareness programme</p>
<img src="http://feeds.feedburner.com/~r/rayfoo-blogcomments/~4/_nid3dtaiXk" height="1" width="1"/>]]></content:encoded>
	<feedburner:origLink>http://blog.rayfoo.info/2011/05/btpcs-amazingrace/comment-page-1#comment-695</feedburner:origLink></item>
	<item>
		<title>Comment on BTPC’s AmazinGrace by Daniel</title>
		<link>http://feedproxy.google.com/~r/rayfoo-blogcomments/~3/lh9RaqJEbDY/comment-page-1</link>
		<dc:creator>Daniel</dc:creator>
		<pubDate>Sun, 22 May 2011 07:59:48 +0000</pubDate>
		<guid isPermaLink="false">http://blog.rayfoo.info/?p=846#comment-675</guid>
		<description>Evangelism outreach?</description>
		<content:encoded><![CDATA[<p>Evangelism outreach?</p>
<img src="http://feeds.feedburner.com/~r/rayfoo-blogcomments/~4/lh9RaqJEbDY" height="1" width="1"/>]]></content:encoded>
	<feedburner:origLink>http://blog.rayfoo.info/2011/05/btpcs-amazingrace/comment-page-1#comment-675</feedburner:origLink></item>
	<item>
		<title>Comment on FireProof by Daniel</title>
		<link>http://feedproxy.google.com/~r/rayfoo-blogcomments/~3/BZX_9gri4IE/comment-page-1</link>
		<dc:creator>Daniel</dc:creator>
		<pubDate>Sun, 22 May 2011 07:59:01 +0000</pubDate>
		<guid isPermaLink="false">http://blog.rayfoo.info/?p=36#comment-674</guid>
		<description>There are others in the series, Facing the Giants, Flywheel, Letters to God.  Fireproof is good too, very apt for couples!! :)</description>
		<content:encoded><![CDATA[<p>There are others in the series, Facing the Giants, Flywheel, Letters to God.  Fireproof is good too, very apt for couples!! <img src='http://blog.rayfoo.info/wp-includes/images/smilies/icon_smile.gif' alt=':)' class='wp-smiley' /> </p>
<img src="http://feeds.feedburner.com/~r/rayfoo-blogcomments/~4/BZX_9gri4IE" height="1" width="1"/>]]></content:encoded>
	<feedburner:origLink>http://blog.rayfoo.info/2009/09/fireproof/comment-page-1#comment-674</feedburner:origLink></item>
	<item>
		<title>Comment on DNS lookups using Python by ray</title>
		<link>http://feedproxy.google.com/~r/rayfoo-blogcomments/~3/7el9JMogeeo/comment-page-1</link>
		<dc:creator>ray</dc:creator>
		<pubDate>Fri, 29 Apr 2011 17:09:08 +0000</pubDate>
		<guid isPermaLink="false">http://blog.rayfoo.info/?p=683#comment-544</guid>
		<description>You're welcome :)  Took a couple of hours of doing dir() on the different objects before I had a better idea on how to use it, glad it helped heh.</description>
		<content:encoded><![CDATA[<p>You&#8217;re welcome <img src='http://blog.rayfoo.info/wp-includes/images/smilies/icon_smile.gif' alt=':)' class='wp-smiley' />   Took a couple of hours of doing dir() on the different objects before I had a better idea on how to use it, glad it helped heh.</p>
<img src="http://feeds.feedburner.com/~r/rayfoo-blogcomments/~4/7el9JMogeeo" height="1" width="1"/>]]></content:encoded>
	<feedburner:origLink>http://blog.rayfoo.info/2010/07/dns-lookups-using-python/comment-page-1#comment-544</feedburner:origLink></item>
	<item>
		<title>Comment on DNS lookups using Python by Cal Leeming</title>
		<link>http://feedproxy.google.com/~r/rayfoo-blogcomments/~3/sgLbRoiYgYg/comment-page-1</link>
		<dc:creator>Cal Leeming</dc:creator>
		<pubDate>Thu, 28 Apr 2011 19:01:07 +0000</pubDate>
		<guid isPermaLink="false">http://blog.rayfoo.info/?p=683#comment-542</guid>
		<description>Thanks for giving this snippet! There is a real lack of documentation for the PyDNS module... ;/ Might ask the author if he'll allow me to modify the docs and contribute nicer documentation.</description>
		<content:encoded><![CDATA[<p>Thanks for giving this snippet! There is a real lack of documentation for the PyDNS module&#8230; ;/ Might ask the author if he&#8217;ll allow me to modify the docs and contribute nicer documentation.</p>
<img src="http://feeds.feedburner.com/~r/rayfoo-blogcomments/~4/sgLbRoiYgYg" height="1" width="1"/>]]></content:encoded>
	<feedburner:origLink>http://blog.rayfoo.info/2010/07/dns-lookups-using-python/comment-page-1#comment-542</feedburner:origLink></item>
</channel>
</rss><!-- Dynamic page generated in 0.362 seconds. --><!-- Cached page generated by WP-Super-Cache on 2011-11-19 13:08:21 --><!-- Compression = gzip -->

