Conversation

Notices

1. Embed this notice
   K. Ryabitsev ???? (monsieuricon@social.kernel.org)'s status on Wednesday, 13-Nov-2024 07:25:42 JST K. Ryabitsev ????

   x.x.x.x - - [10/Nov/2024:00:02:37 +0000] "GET / HTTP/1.1" 301 162 "-" "okhttp/4.9.0"

   You know what’s interesting about this log line? It repeats 56,686,963 times in www.kernel.org logs for yesterday, across 4 nodes. That’s about 700 times a second, and this has been going on for months.

   These requests aren’t intentionally malicious – they issue a simple GET /, receive their 301 redirect, and terminate the connection. From what I can tell, this is some kind of appliance or software installed on mobile clients that uses “can I reach www.kernel.org” as a network test.

   This wouldn’t be that big of a deal – a single plaintext “GET /“ that triggers an immediate 301 is very cheap for us to generate, but the number of these requests has been steadily growing.

   If you have any idea what this is and how to make it stop, please reach out?

   • Haelwenn /элвэн/ :triskell: and Krzysztof Kozlowski like this.
   • Embed this notice
     Robert Link (phaedral@mastodon.social)'s status on Wednesday, 13-Nov-2024 07:35:02 JST Robert Link

     in reply to

     @monsieuricon I instantly think about microsoft and WSL, but that's just prejudice. I recall, however, working for Symantec in 2009, a QA pal being amazed at how many "needless" connections win spawned.

   • Embed this notice
     翠星石 (suiseiseki@freesoftwareextremist.com)'s status on Wednesday, 13-Nov-2024 11:33:16 JST 翠星石

     in reply to
     @monsieuricon Don't respond to the connections and soon enough it will sort itself out.
   • Embed this notice
     feld (feld@friedcheese.us)'s status on Wednesday, 13-Nov-2024 13:37:02 JST feld

     in reply to
     @monsieuricon okhttp is commonly used in Android apps, it appears to be a popular http client used by React Native, and Bluesky uses React Native
     
     That's my left field guess