HTTP 411 errors in weblogs

Since our website's "go-live" 3 days ago, our weblogs have shown that
about 1/3 of our site's unique visitors are getting HTTP 411 errors.
These errors are occurring with a SEARCH request type (as opposed to
GET or POST), and a platform/browser combination of WIN98/IE5.5 (log
details attached). Also, the SEARCH request occurs after the same
address has done a GET to our index.asp. This doesn't appear to be
effecting visitors from a particular region/network.

Crunching the weblogs also shows that approx 70% of visitors are on a
WIN98/IE5.5 combo, which is way above the 6-10% we experience with our
other hosted sites (hosted with same company, but on different
servers).

Has anyone else experienced similar problems, and if so, know of a
fix? Our webhost (Hostway) have initially said that it's a problem
with our code, however we beleive with the high WIN98/IE5.5 combo that
it may be a problem with the server (running win2kadv/IIS 5).

Many Thanks,

Casey

----------

Attached weblog entries

2003-10-01 00:35:26 xxxx.cpe.net.cable.rogers.com - W3SVC305 WSH144
66.113.226.xxx 80 GET /index.asp - 200 0 35594 190 250 HTTP/1.1
66.113.226.xxx Mozilla/4.0+(compatible;+MSIE+5.5;+Windows+9 - -

2003-10-01 00:35:26 xxxx.cpe.net.cable.rogers.com - W3SVC305 WSH144
66.113.226.xxx 80 SEARCH / - 411 0 233 43 0 HTTP/1.1 66.113.226.xxx -
- -

My guess is some scripted program looking
for exploit or digging info of you site.

411 - length required, as it's needed in a Search
verb. nothing much you can do...

what you can do is limit such query by installing
urlscan on accept only certain http verbs. say get/post.

--
Regards,
Bernard Cheah
<a style='text-decoration: underline;' href="http://support.microsoft.com/" target="_blank">http://support.microsoft.com/</a>
Please respond to newsgroups only ...



"Casey" <casey DeleteThis @globenettravel.com.au> wrote in message
news:28c674ce.0310011533.6b90f5cd@posting.google.com...
 > Since our website's "go-live" 3 days ago, our weblogs have shown that
 > about 1/3 of our site's unique visitors are getting HTTP 411 errors.
 > These errors are occurring with a SEARCH request type (as opposed to
 > GET or POST), and a platform/browser combination of WIN98/IE5.5 (log
 > details attached). Also, the SEARCH request occurs after the same
 > address has done a GET to our index.asp. This doesn't appear to be
 > effecting visitors from a particular region/network.
 >
 > Crunching the weblogs also shows that approx 70% of visitors are on a
 > WIN98/IE5.5 combo, which is way above the 6-10% we experience with our
 > other hosted sites (hosted with same company, but on different
 > servers).
 >
 > Has anyone else experienced similar problems, and if so, know of a
 > fix? Our webhost (Hostway) have initially said that it's a problem
 > with our code, however we beleive with the high WIN98/IE5.5 combo that
 > it may be a problem with the server (running win2kadv/IIS 5).
 >
 > Many Thanks,
 >
 > Casey
 >
 > ----------
 >
 > Attached weblog entries
 >
 > 2003-10-01 00:35:26 xxxx.cpe.net.cable.rogers.com - W3SVC305 WSH144
 > 66.113.226.xxx 80 GET /index.asp - 200 0 35594 190 250 HTTP/1.1
 > 66.113.226.xxx Mozilla/4.0+(compatible;+MSIE+5.5;+Windows+9 - -
 >
 > 2003-10-01 00:35:26 xxxx.cpe.net.cable.rogers.com - W3SVC305 WSH144
 > 66.113.226.xxx 80 SEARCH / - 411 0 233 43 0 HTTP/1.1 66.113.226.xxx -
 > - -<!-- ~MESSAGE_AFTER~ -->