>Number: 1569 >Category: mod_log-any >Synopsis: IP address incorrectly recorded in access_log >Confidential: no >Severity: serious >Priority: medium >Responsible: apache >State: open >Class: sw-bug >Submitter-Id: apache >Arrival-Date: Wed Dec 17 07:10:00 PST 1997 >Last-Modified: >Originator: [EMAIL PROTECTED] >Organization: apache >Release: 1.2.4 >Environment: SunOS thoreau 4.1.4 3 sun4m gcc 2.7.2 >Description: Just built 1.2.4 and had one client accessing the httpd process. The correct IP for the client is 139.187.190.155. httpd is configured not to resolv hostnames. Below is the access_log that was generated from a few accesses.
205.227.60.129 - - [17/Dec/1997:08:36:24 -0500] "GET / HTTP/1.0" 200 1316 205.227.60.129 - - [17/Dec/1997:08:36:25 -0500] "GET /apache_pb.gif HTTP/1.0" 20 0 2326 205.227.60.129 - - [17/Dec/1997:08:36:31 -0500] "GET /~hickey/ HTTP/1.0" 200 438 172.16.2.129 - - [17/Dec/1997:08:36:32 -0500] "GET /icons/blank.gif HTTP/1.0" 20 0 148 172.16.2.129 - - [17/Dec/1997:08:36:32 -0500] "GET /icons/text.gif HTTP/1.0" 200 229 205.227.60.129 - - [17/Dec/1997:08:36:32 -0500] "GET /icons/back.gif HTTP/1.0" 2 00 216 205.227.60.129 - - [17/Dec/1997:08:36:39 -0500] "GET /~hickey/AcctInfo.html HTTP /1.0" 200 13435 205.227.60.129 - - [17/Dec/1997:08:36:39 -0500] "GET /images/Return4DA.gif HTTP/ 1.0" 404 173 205.227.60.129 - - [17/Dec/1997:08:37:33 -0500] "GET /perl5 HTTP/1.0" 301 182 139.187.190.155 - - [17/Dec/1997:08:37:34 -0500] "GET /perl5/ HTTP/1.0" 200 427 139.187.190.155 - - [17/Dec/1997:08:37:34 -0500] "GET /icons/back.gif HTTP/1.0" 200 216 139.187.190.155 - - [17/Dec/1997:08:37:34 -0500] "GET /icons/folder.gif HTTP/1.0 " 200 225 139.187.190.155 - - [17/Dec/1997:08:37:34 -0500] "GET /icons/blank.gif HTTP/1.0" 200 148 139.187.190.155 - - [17/Dec/1997:08:37:36 -0500] "GET /icons/unknown.gif HTTP/1. 0" 200 245 139.187.190.155 - - [17/Dec/1997:08:37:36 -0500] "GET /icons/text.gif HTTP/1.0" 200 229 139.187.190.155 - - [17/Dec/1997:08:37:36 -0500] "GET /perl5/lib/ HTTP/1.0" 200 14918 139.187.190.155 - - [17/Dec/1997:08:37:36 -0500] "GET /icons/p.gif HTTP/1.0" 200 237 139.187.190.155 - - [17/Dec/1997:08:37:38 -0500] "GET /perl5/lib/AutoLoader.pm.h tml HTTP/1.0" 200 647 139.187.190.155 - - [17/Dec/1997:08:38:28 -0500] "GET /~hickey/ HTTP/1.0" 200 55 9 139.187.190.155 - - [17/Dec/1997:08:38:31 -0500] "GET /~hickey/spanning-tree.htm l HTTP/1.0" 200 3188 139.187.190.155 - - [17/Dec/1997:08:43:11 -0500] "GET /~hickey/spanning-tree.htm l HTTP/1.0" 200 3298 172.16.2.129 - - [17/Dec/1997:09:08:47 -0500] "GET /~hickey/ HTTP/1.0" 200 670 172.16.2.129 - - [17/Dec/1997:09:08:55 -0500] "GET /~hickey/OUI.html HTTP/1.0" 2 00 62415 205.227.60.129 - - [17/Dec/1997:09:11:22 -0500] "GET /manual/ HTTP/1.0" 200 2207 172.16.2.129 - - [17/Dec/1997:09:11:26 -0500] "GET /manual/images/sub.gif HTTP/1 .0" 200 6083 172.16.2.129 - - [17/Dec/1997:09:11:27 -0500] "GET /manual/images/index.gif HTTP /1.0" 200 1540 172.16.2.129 - - [17/Dec/1997:09:11:37 -0500] "GET /manual/new_features_1_2.html HTTP/1.0" 200 9409 205.227.60.129 - - [17/Dec/1997:09:53:33 -0500] "GET /~hickey/spanning-tree.html HTTP/1.0" 200 3298 >How-To-Repeat: I assume that this is pretty repeatable on all platforms with no specific URLs. My Configuration file can be sent if you need to rebuild a httpd to test again (if module conflicts are thought to be the issue). >Fix: >Audit-Trail: >Unformatted: [In order for any reply to be added to the PR database, ] [you need to include <[EMAIL PROTECTED]> in the Cc line ] [and leave the subject line UNCHANGED. This is not done] [automatically because of the potential for mail loops. ]
