Mystery server hits

[NotionCommotion]

Thanks again for the help regarding http://forums.phpfreaks.com/topic/294335-why-is-firefox-hitting-my-server-twice/.  Some of my issues are fixed.

 

I still get some mystery hits to my server, and this time it has nothing to do with FireFox and images without src attributes.

 

I think I have a theory, and would like confirmation.

 

I have a virtualhost /var/www/main/html which is used for IDE development only.  In it, I change $_SERVER['HTTP_HOST'] from 192.168.1.200 to something like test.sites.example.com and have a require statement which changes control to another file served by another virtualhost.  This is what confused me as I would browse through the second virtual host, and see these mystery server hits.

 

So, it appears that the script I was utilizing had nothing to do with the mysterious hits, but that the IDE would periodically send some request to the server maybe to ensure it was up and running.

 

You know, through the process of writing this post, I am sure that is what was happening.  I thought about not even posting it, however, it was mostly written and maybe it will keep someone from thinking they are going crazy.

 

Mystery $_SERVER array

Array(
    [HTTP_HOST] => 192.168.1.200
    [PATH] => /sbin:/usr/sbin:/bin:/usr/bin
    [SERVER_SIGNATURE] => <address>Apache/2.2.15 (CentOS) Server at 192.168.1.200 Port 80</address>
    [SERVER_SOFTWARE] => Apache/2.2.15 (CentOS)
    [SERVER_NAME] => 192.168.1.200
    [SERVER_ADDR] => 192.168.1.200
    [SERVER_PORT] => 80
    [REMOTE_ADDR] => 192.168.1.1
    [DOCUMENT_ROOT] => /var/www/main/html
    [SERVER_ADMIN] => root@localhost
    [SCRIPT_FILENAME] => /var/www/main/html/index.php
    [REMOTE_PORT] => 48417
    [GATEWAY_INTERFACE] => CGI/1.1
    [SERVER_PROTOCOL] => HTTP/1.1
    [REQUEST_METHOD] => GET
    [QUERY_STRING] =>
    [REQUEST_URI] => /
    [SCRIPT_NAME] => /index.php
    [PHP_SELF] => /index.php
    [REQUEST_TIME_FLOAT] => 1423058984.084
    [REQUEST_TIME] => 1423058984
)

Normal $_SERVER array

Array
(
    [REDIRECT_HTTPS] => on
    [REDIRECT_SSL_TLS_SNI] => test.sites.example.com
    [REDIRECT_STATUS] => 200
    [HTTPS] => on
    [SSL_TLS_SNI] => test.sites.example.com
    [HTTP_HOST] => test.sites.example.com
    [HTTP_USER_AGENT] => Mozilla/5.0 (Windows NT 6.1; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0
    [HTTP_ACCEPT] => text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    [HTTP_ACCEPT_LANGUAGE] => en-US,en;q=0.5
    [HTTP_ACCEPT_ENCODING] => gzip, deflate
    [HTTP_REFERER] => https://test.sites.example.com/administrator/index.php?cid=3
    [HTTP_COOKIE] => BACKSESSID=n6fgecgcd58aqujjtukf9gah86; PREVSESSID=9pnbb1eiighi1aantuqf2j3ei4
    [HTTP_CONNECTION] => keep-alive
    [HTTP_CACHE_CONTROL] => max-age=0
    [PATH] => /sbin:/usr/sbin:/bin:/usr/bin
    [SERVER_SIGNATURE] => Apache/2.2.15 (CentOS) Server at test.sites.example.com Port 443
    [SERVER_SOFTWARE] => Apache/2.2.15 (CentOS)
    [SERVER_NAME] => test.sites.example.com
    [SERVER_ADDR] => 192.168.1.200
    [SERVER_PORT] => 443
    [REMOTE_ADDR] => 192.168.1.1
    [DOCUMENT_ROOT] => /var/www/main/html_sites
    [SERVER_ADMIN] => root@localhost
    [SCRIPT_FILENAME] => /var/www/main/html_sites/index.php
    [REMOTE_PORT] => 58408
    [REDIRECT_QUERY_STRING] => admin=administrator/index.php&cid=4&controller=list
    [REDIRECT_URL] => /administrator/index.php
    [GATEWAY_INTERFACE] => CGI/1.1
    [SERVER_PROTOCOL] => HTTP/1.1
    [REQUEST_METHOD] => GET
    [QUERY_STRING] => admin=administrator/index.php&cid=4&controller=list
    [REQUEST_URI] => /administrator/index.php?cid=4&controller=list
    [SCRIPT_NAME] => /index.php
    [PHP_SELF] => /index.php
    [REQUEST_TIME_FLOAT] => 1423057852.769
    [REQUEST_TIME] => 1423057852
)

 

[requinix]

Not too sure I understand what you're seeing...

 

It looks like there's two (or more) virtualhosts: one for 192.168.1.200 and one for test.sites.example.com. The IDE (presumably?) is making a request to the former for some reason - maybe there's an old configuration pointing to the IP address instead of the hostname? It does seem like a ping of sorts because it doesn't have any of the normal HTTP headers in the request.