Hi,
now I have more precise data. The samples have been taken during 5 days.
There where 10 million acceses to the server. 461 of these had corrupt
headers. So increasing Log level is not really feasible.
Browsers with corrupt headers (including count):
309 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt)
34 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 95; DigExt)
28 Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)
11 Mozilla/4.0 (compatible; MSIE 5.0; MSN 2.5; AOL 5.0; Windows 98; DigExt)
10 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt; DT)
8 Mozilla/4.0 (compatible; MSIE 5.0; AOL 6.0; Windows 98; DigExt)
6 Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)
5 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt;
T-Online Internatinal AG)
5 Mozilla/4.0 (compatible; MSIE 5.0; AOL 4.0; Windows 98; DigExt)
2 Mozilla/4.0 (compatible; MSIE 5.0; MSN 2.5; AOL 5.0; Windows 98)
2 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt; tn3.0)
2 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt; pi
3.0.0.0)
2 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt; Creative)
2 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt; A0111)
2 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt;
*/E-Plus-002)
2 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 95; DT; DigExt)
2 Mozilla/2.0 (compatible; MSIE 3.02; AOL 3.0; Windows 95)
1 Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt; Quicken 98 DE)
1 Mozilla/4.0 (compatible; MSIE 5.0; Windows 95; DigExt)
1 Mozilla/4.0 (compatible; MSIE 5.0; Windows 95; DT; DigExt)
1 Mozilla/4.0 (compatible; MSIE 5.0; MSN 2.5; Windows 98; DigExt)
1 Mozilla/4.0 (compatible; MSIE 5.0; MSN 2.5; AOL 5.0; Windows 98;
DigExt; UUNET-DE)
1 Mozilla/4.0 (compatible; MSIE 5.0; CS 2000; Windows 98; DigExt;
CompuServe Deutschland IE 5.0)
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 6.0; Windows 95; DigExt)
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; surfEU DE M1)
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; QXW0332o)
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; PKBL008; DigExt)
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt;
pbc4.0.0.0)
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt;
o.tel.o online IFA99)
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt;
freenet 4.0)
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt; chip 1)
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt;
Vi-Interkom 1.0.2.1)
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt;
QXW03318; pbc4.0.0.0)
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt; QXW03314)
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt; MIST1.01)
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt; AIS3.01)
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt; 1&1
Internet AG)
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DT; Quicken
98 DE; DigExt)
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DT; DigExt)
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98)
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 95; DigExt;
debitel.net 3.0)
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 4.0; Windows 98; DigExt;
T-Online Internatinal AG)
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 4.0; Windows 98; DigExt; QXW03018)
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 4.0; Windows 98; DigExt; DT)
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 4.0; Windows 95; DigExt)
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 4.0; Windows 95; DT;
talknet2.0; DigExt)
The corrupt headers themselves (including count) obtained by mod_log_config:
421 applicationent-Type: application/x-www-form-urlencoded
29 application/x-www-form-urlencoded, application/x-www-form-urlencoded
6 applicationontent-Type: application/x-www-form-urlencoded
3 application0.5, application/x-www-form-urlencoded
1 application;q=0.5, application/x-www-form-urlencoded
1 application;q=0.7,fr;q=0.3, application/x-www-form-urlencoded
SSL ciphers and key length (including count):
433 RC4-MD5 128 128
28 EDH-RSA-DES-CBC3-SHA 168 168
The 28 requests from "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)" where
exactly those using EDH-RSA-DES-CBC3-SHA and they all had Content-Type
"application/x-www-form-urlencoded, application/x-www-form-urlencoded", but
there was one more of that type using RC4-MD5 coming from "Mozilla/4.0
(compatible; MSIE 5.0; Windows 95; DT; DigExt)". Also these 28 requests had
a Referrer-Header that contained the value duplicate, separated by a comma
(so the same situation here, as in the Content-Type header". So these 28
cases might be something special. All the others look slightly different.
The IP nets with problems where:
137 195.93.64
129 195.93.65
117 195.93.66
28 64.0.99
6 205.188.199
6 205.188.193
3 152.163.205
3 152.163.204
3 152.163.197
2 64.12.105
2 205.188.195
2 205.188.192
2 172.178.45
2 172.176.5
2 152.163.195
1 64.12.104
1 64.12.102
1 205.188.198
1 205.188.197
1 195.252.191
1 193.189.244
1 172.178.112
1 172.176.24
1 172.176.170
1 172.176.10
1 172.168.123
1 172.155.119
1 172.151.108
1 172.149.100
1 172.139.117
1 152.163.213
1 152.163.194
The detailed list of IP addresses:
28 proxy.ord2.netsetter.com 64.0.99.168
11 spider-fra-ta044.proxy.aol.com 195.93.64.169
10 spider-fra-tb013.proxy.aol.com 195.93.65.153
10 spider-fra-ta043.proxy.aol.com 195.93.64.168
8 spider-fra-tc074.proxy.aol.com 195.93.66.184
8 spider-fra-tc051.proxy.aol.com 195.93.66.171
8 spider-fra-tc013.proxy.aol.com 195.93.66.153
8 spider-fra-tb053.proxy.aol.com 195.93.65.173
8 spider-fra-tb042.proxy.aol.com 195.93.65.167
8 spider-fra-tb021.proxy.aol.com 195.93.65.156
7 spider-fra-tc064.proxy.aol.com 195.93.66.179
7 spider-fra-tc052.proxy.aol.com 195.93.66.172
7 spider-fra-tb071.proxy.aol.com 195.93.65.181
7 spider-fra-ta071.proxy.aol.com 195.93.64.181
7 spider-fra-ta064.proxy.aol.com 195.93.64.179
7 spider-fra-ta051.proxy.aol.com 195.93.64.171
7 spider-fra-ta042.proxy.aol.com 195.93.64.167
7 spider-fra-ta034.proxy.aol.com 195.93.64.164
7 spider-fra-ta033.proxy.aol.com 195.93.64.163
6 spider-fra-tb074.proxy.aol.com 195.93.65.184
6 spider-fra-tb072.proxy.aol.com 195.93.65.182
6 spider-fra-tb054.proxy.aol.com 195.93.65.174
6 spider-fra-tb051.proxy.aol.com 195.93.65.171
6 spider-fra-tb022.proxy.aol.com 195.93.65.157
6 spider-fra-ta063.proxy.aol.com 195.93.64.178
5 spider-fra-tc083.proxy.aol.com 195.93.66.188
5 spider-fra-tc063.proxy.aol.com 195.93.66.178
5 spider-fra-tc034.proxy.aol.com 195.93.66.164
5 spider-fra-tc012.proxy.aol.com 195.93.66.152
5 spider-fra-tb061.proxy.aol.com 195.93.65.176
5 spider-fra-tb044.proxy.aol.com 195.93.65.169
5 spider-fra-tb041.proxy.aol.com 195.93.65.166
5 spider-fra-tb032.proxy.aol.com 195.93.65.162
5 spider-fra-tb031.proxy.aol.com 195.93.65.161
5 spider-fra-ta083.proxy.aol.com 195.93.64.188
5 spider-fra-ta082.proxy.aol.com 195.93.64.187
5 spider-fra-ta072.proxy.aol.com 195.93.64.182
5 spider-fra-ta062.proxy.aol.com 195.93.64.177
5 spider-fra-ta061.proxy.aol.com 195.93.64.176
5 spider-fra-ta022.proxy.aol.com 195.93.64.157
4 spider-fra-tc082.proxy.aol.com 195.93.66.187
4 spider-fra-tc081.proxy.aol.com 195.93.66.186
4 spider-fra-tc043.proxy.aol.com 195.93.66.168
4 spider-fra-tc024.proxy.aol.com 195.93.66.159
4 spider-fra-tc023.proxy.aol.com 195.93.66.158
4 spider-fra-tc021.proxy.aol.com 195.93.66.156
4 spider-fra-tb073.proxy.aol.com 195.93.65.183
4 spider-fra-tb012.proxy.aol.com 195.93.65.152
4 spider-fra-ta084.proxy.aol.com 195.93.64.189
4 spider-fra-ta032.proxy.aol.com 195.93.64.162
3 spider-fra-tc084.proxy.aol.com 195.93.66.189
3 spider-fra-tc073.proxy.aol.com 195.93.66.183
3 spider-fra-tc062.proxy.aol.com 195.93.66.177
3 spider-fra-tc054.proxy.aol.com 195.93.66.174
3 spider-fra-tc033.proxy.aol.com 195.93.66.163
3 spider-fra-tc022.proxy.aol.com 195.93.66.157
3 spider-fra-tb064.proxy.aol.com 195.93.65.179
3 spider-fra-tb062.proxy.aol.com 195.93.65.177
3 spider-fra-tb033.proxy.aol.com 195.93.65.163
3 spider-fra-tb023.proxy.aol.com 195.93.65.158
3 spider-fra-ta074.proxy.aol.com 195.93.64.184
3 spider-fra-ta073.proxy.aol.com 195.93.64.183
3 spider-fra-ta053.proxy.aol.com 195.93.64.173
3 spider-fra-ta052.proxy.aol.com 195.93.64.172
3 spider-fra-ta041.proxy.aol.com 195.93.64.166
3 spider-fra-ta031.proxy.aol.com 195.93.64.161
3 spider-fra-ta024.proxy.aol.com 195.93.64.159
3 spider-fra-ta023.proxy.aol.com 195.93.64.158
2 spider-wl072.proxy.aol.com 205.188.199.52
2 spider-wd021.proxy.aol.com 205.188.193.156
2 spider-wd014.proxy.aol.com 205.188.193.154
2 spider-to022.proxy.aol.com 152.163.204.52
2 spider-mtc-ta043.proxy.aol.com 64.12.105.38
2 spider-fra-tc072.proxy.aol.com 195.93.66.182
2 spider-fra-tc071.proxy.aol.com 195.93.66.181
2 spider-fra-tc053.proxy.aol.com 195.93.66.173
2 spider-fra-tc042.proxy.aol.com 195.93.66.167
2 spider-fra-tc041.proxy.aol.com 195.93.66.166
2 spider-fra-tc031.proxy.aol.com 195.93.66.161
2 spider-fra-tb063.proxy.aol.com 195.93.65.178
2 spider-fra-tb052.proxy.aol.com 195.93.65.172
2 spider-fra-tb043.proxy.aol.com 195.93.65.168
2 spider-fra-tb034.proxy.aol.com 195.93.65.164
2 spider-fra-tb024.proxy.aol.com 195.93.65.159
2 spider-fra-tb014.proxy.aol.com 195.93.65.154
2 spider-fra-ta081.proxy.aol.com 195.93.64.186
2 spider-fra-ta054.proxy.aol.com 195.93.64.174
2 spider-fra-ta021.proxy.aol.com 195.93.64.156
2 ACB22D7F.ipt.aol.com 172.178.45.127
2 ACB005D0.ipt.aol.com 172.176.5.208
1 spider-wm084.proxy.aol.com 205.188.199.189
1 spider-wm073.proxy.aol.com 205.188.199.183
1 spider-wm051.proxy.aol.com 205.188.199.171
1 spider-wl034.proxy.aol.com 205.188.199.34
1 spider-wk041.proxy.aol.com 205.188.198.166
1 spider-wi031.proxy.aol.com 205.188.197.31
1 spider-we082.proxy.aol.com 205.188.195.57
1 spider-we013.proxy.aol.com 205.188.195.23
1 spider-wd013.proxy.aol.com 205.188.193.153
1 spider-wd011.proxy.aol.com 205.188.193.151
1 spider-wb064.proxy.aol.com 205.188.192.179
1 spider-wb031.proxy.aol.com 205.188.192.161
1 spider-to013.proxy.aol.com 152.163.204.48
1 spider-tm044.proxy.aol.com 152.163.197.64
1 spider-tm021.proxy.aol.com 152.163.197.51
1 spider-tj062.proxy.aol.com 152.163.213.202
1 spider-ti031.proxy.aol.com 152.163.194.186
1 spider-tf083.proxy.aol.com 152.163.197.213
1 spider-te073.proxy.aol.com 152.163.195.208
1 spider-te042.proxy.aol.com 152.163.195.192
1 spider-ta081.proxy.aol.com 152.163.205.81
1 spider-ta052.proxy.aol.com 152.163.205.67
1 spider-ta021.proxy.aol.com 152.163.205.51
1 spider-mtc-tg034.proxy.aol.com 64.12.102.164
1 spider-mtc-td062.proxy.aol.com 64.12.104.177
1 spider-fra-tc061.proxy.aol.com 195.93.66.176
1 spider-fra-tc044.proxy.aol.com 195.93.66.169
1 spider-fra-tc032.proxy.aol.com 195.93.66.162
1 spider-fra-tc014.proxy.aol.com 195.93.66.154
1 spider-fra-tc011.proxy.aol.com 195.93.66.151
1 spider-fra-tb011.proxy.aol.com 195.93.65.151
1 gateway.aol.de 193.189.244.146
1 a1as13-p103.stg.tli.de 195.252.191.103
1 ACB270FA.ipt.aol.com 172.178.112.250
1 ACB0AAA6.ipt.aol.com 172.176.170.166
1 ACB01808.ipt.aol.com 172.176.24.8
1 ACB00A71.ipt.aol.com 172.176.10.113
1 ACA87BF5.ipt.aol.com 172.168.123.245
1 AC9B77BF.ipt.aol.com 172.155.119.191
1 AC976C84.ipt.aol.com 172.151.108.132
1 AC9564BA.ipt.aol.com 172.149.100.186
1 AC8B7506.ipt.aol.com 172.139.117.6
The relation between corrupt header and IP-net is as follows:
3 195.93.66 application0.5, application/x-www-form-urlencoded
1 195.93.65 application;q=0.5, application/x-www-form-urlencoded
1 195.93.65 application;q=0.7,fr;q=0.3,
application/x-www-form-urlencoded
1 152.163.194 applicationent-Type: application/x-www-form-urlencoded
2 152.163.195 applicationent-Type: application/x-www-form-urlencoded
2 152.163.197 applicationent-Type: application/x-www-form-urlencoded
3 152.163.204 applicationent-Type: application/x-www-form-urlencoded
3 152.163.205 applicationent-Type: application/x-www-form-urlencoded
1 152.163.213 applicationent-Type: application/x-www-form-urlencoded
1 172.139.117 applicationent-Type: application/x-www-form-urlencoded
1 172.149.100 applicationent-Type: application/x-www-form-urlencoded
1 172.151.108 applicationent-Type: application/x-www-form-urlencoded
1 172.155.119 applicationent-Type: application/x-www-form-urlencoded
1 172.168.123 applicationent-Type: application/x-www-form-urlencoded
1 172.176.10 applicationent-Type: application/x-www-form-urlencoded
1 172.176.170 applicationent-Type: application/x-www-form-urlencoded
1 172.176.24 applicationent-Type: application/x-www-form-urlencoded
2 172.176.5 applicationent-Type: application/x-www-form-urlencoded
1 172.178.112 applicationent-Type: application/x-www-form-urlencoded
2 172.178.45 applicationent-Type: application/x-www-form-urlencoded
1 193.189.244 applicationent-Type: application/x-www-form-urlencoded
137 195.93.64 applicationent-Type: application/x-www-form-urlencoded
125 195.93.65 applicationent-Type: application/x-www-form-urlencoded
113 195.93.66 applicationent-Type: application/x-www-form-urlencoded
2 205.188.192 applicationent-Type: application/x-www-form-urlencoded
5 205.188.193 applicationent-Type: application/x-www-form-urlencoded
2 205.188.195 applicationent-Type: application/x-www-form-urlencoded
1 205.188.198 applicationent-Type: application/x-www-form-urlencoded
6 205.188.199 applicationent-Type: application/x-www-form-urlencoded
1 64.12.102 applicationent-Type: application/x-www-form-urlencoded
1 64.12.104 applicationent-Type: application/x-www-form-urlencoded
2 64.12.105 applicationent-Type: application/x-www-form-urlencoded
1 152.163.197 applicationontent-Type: application/x-www-form-urlencoded
2 195.93.65 applicationontent-Type: application/x-www-form-urlencoded
1 195.93.66 applicationontent-Type: application/x-www-form-urlencoded
1 205.188.193 applicationontent-Type: application/x-www-form-urlencoded
1 205.188.197 applicationontent-Type: application/x-www-form-urlencoded
1 64.0.99 482 application/x-www-form-urlencoded,
application/x-www-form-urlencoded
1 195.252.191 application/x-www-form-urlencoded,
application/x-www-form-urlencoded
27 64.0.99 application/x-www-form-urlencoded,
application/x-www-form-urlencoded
The relation between Browser and header is:
300 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt)
applicationent-Type: application/x-www-form-urlencoded
32 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 95; DigExt)
applicationent-Type: application/x-www-form-urlencoded
28 Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)
application/x-www-form-urlencoded, application/x-www-form-urlencoded
11 Mozilla/4.0 (compatible; MSIE 5.0; MSN 2.5; AOL 5.0; Windows 98;
DigExt) applicationent-Type: application/x-www-form-urlencoded
10 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt; DT)
applicationent-Type: application/x-www-form-urlencoded
8 Mozilla/4.0 (compatible; MSIE 5.0; AOL 6.0; Windows 98; DigExt)
applicationent-Type: application/x-www-form-urlencoded
6 Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)
applicationent-Type: application/x-www-form-urlencoded
5 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt;
T-Online Internatinal AG) applicationent-Type:
application/x-www-form-urlencoded
5 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt)
applicationontent-Type: application/x-www-form-urlencoded
5 Mozilla/4.0 (compatible; MSIE 5.0; AOL 4.0; Windows 98; DigExt)
applicationent-Type: application/x-www-form-urlencoded
2 Mozilla/4.0 (compatible; MSIE 5.0; MSN 2.5; AOL 5.0; Windows 98)
applicationent-Type: application/x-www-form-urlencoded
2 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt;
tn3.0) applicationent-Type: application/x-www-form-urlencoded
2 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt; pi
3.0.0.0) applicationent-Type: application/x-www-form-urlencoded
2 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt;
Creative) applicationent-Type: application/x-www-form-urlencoded
2 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt;
A0111) applicationent-Type: application/x-www-form-urlencoded
2 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt;
*/E-Plus-002) applicationent-Type: application/x-www-form-urlencoded
2 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt)
application0.5, application/x-www-form-urlencoded
2 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 95; DT; DigExt)
applicationent-Type: application/x-www-form-urlencoded
2 Mozilla/2.0 (compatible; MSIE 3.02; AOL 3.0; Windows 95)
applicationent-Type: application/x-www-form-urlencoded
2
1 Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt; Quicken 98 DE)
applicationent-Type: application/x-www-form-urlencoded
1 Mozilla/4.0 (compatible; MSIE 5.0; Windows 95; DigExt)
applicationent-Type: application/x-www-form-urlencoded
1 Mozilla/4.0 (compatible; MSIE 5.0; Windows 95; DT; DigExt)
application/x-www-form-urlencoded, application/x-www-form-urlencoded
1 Mozilla/4.0 (compatible; MSIE 5.0; MSN 2.5; Windows 98; DigExt)
applicationent-Type: application/x-www-form-urlencoded
1 Mozilla/4.0 (compatible; MSIE 5.0; MSN 2.5; AOL 5.0; Windows 98;
DigExt; UUNET-DE) applicationent-Type: application/x-www-form-urlencoded
1 Mozilla/4.0 (compatible; MSIE 5.0; CS 2000; Windows 98; DigExt;
CompuServe Deutschland IE 5.0) applicationent-Type:
application/x-www-form-urlencoded
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 6.0; Windows 95; DigExt)
applicationent-Type: application/x-www-form-urlencoded
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; surfEU DE M1)
applicationent-Type: application/x-www-form-urlencoded
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; QXW0332o)
applicationent-Type: application/x-www-form-urlencoded
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; PKBL008;
DigExt) applicationent-Type: application/x-www-form-urlencoded
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt;
pbc4.0.0.0) applicationent-Type: application/x-www-form-urlencoded
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt;
o.tel.o online IFA99) applicationent-Type: application/x-www-form-urlencoded
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt;
freenet 4.0) applicationent-Type: application/x-www-form-urlencoded
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt; chip
1) applicationent-Type: application/x-www-form-urlencoded
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt;
Vi-Interkom 1.0.2.1) applicationent-Type: application/x-www-form-urlencoded
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt;
QXW03318; pbc4.0.0.0) applicationent-Type: application/x-www-form-urlencoded
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt;
QXW03314) applicationent-Type: application/x-www-form-urlencoded
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt;
MIST1.01) applicationent-Type: application/x-www-form-urlencoded
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt;
AIS3.01) applicationent-Type: application/x-www-form-urlencoded
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt; 1&1
Internet AG) applicationent-Type: application/x-www-form-urlencoded
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt)
application;q=0.7,fr;q=0.3, application/x-www-form-urlencoded
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt)
application;q=0.5, application/x-www-form-urlencoded
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DT; Quicken
98 DE; DigExt) applicationent-Type: application/x-www-form-urlencoded
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98; DT; DigExt)
applicationent-Type: application/x-www-form-urlencoded
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 98)
applicationent-Type: application/x-www-form-urlencoded
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 95; DigExt;
debitel.net 3.0) applicationent-Type: application/x-www-form-urlencoded
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 95; DigExt)
applicationontent-Type: application/x-www-form-urlencoded
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 95; DigExt)
application0.5, application/x-www-form-urlencoded
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 4.0; Windows 98; DigExt;
T-Online Internatinal AG) applicationent-Type:
application/x-www-form-urlencoded
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 4.0; Windows 98; DigExt;
QXW03018) applicationent-Type: application/x-www-form-urlencoded
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 4.0; Windows 98; DigExt; DT)
applicationent-Type: application/x-www-form-urlencoded
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 4.0; Windows 95; DigExt)
applicationent-Type: application/x-www-form-urlencoded
1 Mozilla/4.0 (compatible; MSIE 5.0; AOL 4.0; Windows 95; DT;
talknet2.0; DigExt) applicationent-Type: application/x-www-form-urlencoded
At 20:08 25.09.01 , you wrote:
>I think that this is important, as I am having specific issues with AOL
>customers getting errors. Can you tell
>me how to independently verify this problem? How do you find the
>Content-type header that the browser
>(AOL) receives when running SSL?
>
>Problem Browsers
>-------------
>Mozilla/4.0 (compatible; MSIE 5.0; Mac_PowerPC)
>Mozilla/4.0 (compatible; MSIE 5.0; AOL 6.0; Windows 98; Compaq; DigEx)
>Mozilla/4.0 (compatible; MSIE 5.0; AOL 5.0; Windows 95; DigExt)
>
>Ok Browsers
>-------------
>Mozilla/4.0 (compatible; MSIE 4.01; AOL 6.0; Windows 98)
>Mozilla/4.0 (compatible; MSIE 5.0; CS 2000; Windows 98; DigExt)
>Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 4.0)
>Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)
>Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
>Mozilla/4.0 (compatible; MSIE 5.0; Windows 95; DigExt; TUCOWS)
>Mozilla/4.77C-CCK-MCD {C-UDP; EBM-APPLE} (Macintosh; U; PPC)
>Mozilla/4.78 (Macintosh; U; PPC)
>Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)
>Mozilla/4.0 (compatible; MSIE 5.01; Windows NT)
>
>
>Nick
>
>*********** REPLY SEPARATOR ***********
>
>On 9/25/2001 at 12:21 PM Rainer Jung wrote:
>
> >But even if the address changes:
> >
> >as far as SSL is concerned they connect successful, but the
> >Content-Type-header corruption looks like a bug in memory allocation. So
> >some special AOL behaviour might be responsible for running through parts
> >of mod_ssl code which are rarely used and might contain the bug.
> >
> >By the way: is there a way to sniff the ssl communication and decode later
> >on with session cache enabled? The only tool I know is ssldump and that
> >one
> >does not work with the cache enabled, because it doesn't remember the keys
> >for using when the session is resumed. That's the reason we some time had
> >to disable the cache (we wanted to debug another problem) and then noticed
> >that the AOL problem also went away.
> >
> >
> >At 11:59 25.09.01 , you wrote:
> >>On Tue, Sep 25, 2001 at 11:46:24AM +0200, Rainer Jung wrote:
> >> > Hi,
> >> >
> >> > we notice the following problem:
> >> >
> >> > HTTP-Header Content-Type gets corrupt in rare cases for AOL users, if
> >we
> >> > enable shared memory ssl session cache.
> >> >
> >> > Setup: We have apache 1.3.14 with mod_ssl (I don't have the version at
> >> > hand). Behind we use tomcat 3.2.23 on the same system to respond to
> >> > JSP-requests. Betwenn apache and tomcat we use mod_jk with ajp13. We
> >> > noticed, that tomcat sometimes did not find the contents of the POST
> >> buffer
> >> > and found out, that already before parsing the Request to tomcat, the
> >> > Content-Type-Header of the request, which we can print out early in
> >mod_jk
> >> > is corrupt. It contains a concatenation of the correct string
> >> > x-www-form-urlencoded with a part of the string "Content-Type" and then
> >> > again x-www-form-urlencoded.
> >> >
> >> > The problem only happened to users coming from AOL, but for diverse
> >> > browsers. But: is we disable the session cache (shm) the problems
> >vanishes.
> >> >
> >> > Platform is Solaris 2.6. The site is high-volume and uses strong
> >> > encryption. The problem is not strictly User or Browser dependant, it
> >> > occurs kind of statistically but only for Clients coming from
> >> > AOL-IP-adresses and only if session cache is enabled. Apart from that
> >> > communication seems to work good.
> >> >
> >> > Any comments?
> >> >
> >>Strange - usually people run into problems when they don't have their
> >session
> >>cache on :)
> >>Since this probably is AOL specific, perhaps it happens because they
> >proxy
> >>their
> >>ssl connections. AFAIK they proxy outgoing connections (at least for
> >HTTP) and
> >>you can't be sure that all requests from a user will be comming from the
> >same
> >>proxy even over a short period of time. I don't know if this is the case,
> >but
> >>raising your SSLLogLevel such that you can see wether it is session cache
> >hits
> >>or misses and wether the ip adress changes.
> >>
> >>vh
> >>
> >>Mads Toftum
> >>--
> >>With a rubber duck, one's never alone.
> >> -- "The Hitchhiker's Guide to the Galaxy"
> >>______________________________________________________________________
> >>Apache Interface to OpenSSL (mod_ssl) www.modssl.org
> >>User Support Mailing List [EMAIL PROTECTED]
> >>Automated List Manager [EMAIL PROTECTED]
> >
> >______________________________________________________________________
> >Apache Interface to OpenSSL (mod_ssl) www.modssl.org
> >User Support Mailing List [EMAIL PROTECTED]
> >Automated List Manager [EMAIL PROTECTED]
>
>
>
>______________________________________________________________________
>Apache Interface to OpenSSL (mod_ssl) www.modssl.org
>User Support Mailing List [EMAIL PROTECTED]
>Automated List Manager [EMAIL PROTECTED]
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
