http://jackxiang.com/index.php zh-cn http://jackxiang.com/post// jack <xdy108@126.com> Thu, 15 Sep 2016 04:45:11 +0000 http://jackxiang.com/post//

我的Web服务器在用的Linx + Mysql + PHP +nginx，今天被DDOS攻击了，观察日志中发现大量的499 Status Code这个错误。GOOGLE了一把才明白这个499的意思：
日志如下:

222.189.237.18 - - [06/Nov/2011:12:23:27 +0800] "GET / HTTP/1.1" 499 0 "-" "-" "-" rt=0.012 ut="-" cs=-
222.189.237.18 - - [06/Nov/2011:12:23:27 +0800] "GET / HTTP/1.1" 499 0 "-" "-" "-" rt=0.015 ut="-" cs=-
222.215.105.135 - - [06/Nov/2011:12:23:27 +0800] "GET / HTTP/1.1" 499 0 "-" "-" "-" rt=0.015 ut="-" cs=-
222.189.237.18 - - [06/Nov/2011:12:23:27 +0800] "GET / HTTP/1.1" 499 0 "-" "-" "-" rt=0.002 ut="-" cs=-
119.147.86.178 - - [06/Nov/2011:12:23:27 +0800] "GET / HTTP/1.1" 499 0 "-" "-" "-" rt=0.000 ut="-" cs=-
222.189.237.18 - - [06/Nov/2011:12:23:27 +0800] "GET / HTTP/1.1" 499 0 "-" "-" "-" rt=0.000 ut="-" cs=-
61.219.178.101 - - [06/Nov/2011:12:23:27 +0800] "GET / HTTP/1.1" 499 0 "-" "-" "-" rt=0.002 ut="-" cs=-
58.49.59.142 - - [06/Nov/2011:12:23:27 +0800] "GET / HTTP/1.1" 499 0 "-" "-" "-" rt=0.000 ut="-" cs=-
202.201.252.2 - - [06/Nov/2011:12:23:27 +0800] "GET / HTTP/1.1" 499 0 "-" "-" "-" rt=0.000 ut="-" cs=-
202.201.252.2 - - [06/Nov/2011:12:23:27 +0800] "GET / HTTP/1.1" 499 0 "-" "-" "-" rt=0.000 ut="-" cs=-
119.147.86.178 - - [06/Nov/2011:12:23:27 +0800] "GET / HTTP/1.1" 499 0 "-" "-" "-" rt=0.000 ut="-" cs=-
58.221.37.82 - - [06/Nov/2011:12:23:27 +0800] "GET / HTTP/1.1" 499 0 "-" "-" "-" rt=0.039 ut="-" cs=-
222.189.237.18 - - [06/Nov/2011:12:23:27 +0800] "GET / HTTP/1.1" 499 0 "-" "-" "-" rt=0.001 ut="-" cs=-
58.49.59.142 - - [06/Nov/2011:12:23:27 +0800] "GET / HTTP/1.1" 499 0 "-" "-" "-" rt=0.000 ut="-" cs=-
58.49.59.142 - - [06/Nov/2011:12:23:27 +0800] "GET / HTTP/1.1" 499 0 "-" "-" "-" rt=0.045 ut="-" cs=-
119.147.86.178 - - [06/Nov/2011:12:23:27 +0800] "GET / HTTP/1.1" 499 0 "-" "-" "-" rt=0.036 ut="-" cs=-
222.189.237.18 - - [06/Nov/2011:12:23:27 +0800] "GET / HTTP/1.1" 499 0 "-" "-" "-" rt=0.000 ut="-" cs=-
222.189.237.18 - - [06/Nov/2011:12:23:27 +0800] "GET / HTTP/1.1" 499 0 "-" "-" "-" rt=0.037 ut="-" cs=-
222.215.105.135 - - [06/Nov/2011:12:23:27 +0800] "GET / HTTP/1.1" 499 0 "-" "-" "-" rt=0.000 ut="-" cs=-

222.189.237.18 - - [06/Nov/2011:12:23:27 +0800] "GET / HTTP/1.1" 499 0 "-" "-" "-" rt=0.012 ut="-" cs=-
222.189.237.18 - - [06/Nov/2011:12:23:27 +0800] "GET / HTTP/1.1" 499 0 "-" "-" "-" rt=0.015 ut="-" cs=-
222.215.105.135 - - [06/Nov/2011:12:23:27 +0800] "GET / HTTP/1.1" 499 0 "-" "-" "-" rt=0.015 ut="-" cs=-
222.189.237.18 - - [06/Nov/2011:12:23:27 +0800] "GET / HTTP/1.1" 499 0 "-" "-" "-" rt=0.002 ut="-" cs=-
119.147.86.178 - - [06/Nov/2011:12:23:27 +0800] "GET / HTTP/1.1" 499 0 "-" "-" "-" rt=0.000 ut="-" cs=-
222.189.237.18 - - [06/Nov/2011:12:23:27 +0800] "GET / HTTP/1.1" 499 0 "-" "-" "-" rt=0.000 ut="-" cs=-
61.219.178.101 - - [06/Nov/2011:12:23:27 +0800] "GET / HTTP/1.1" 499 0 "-" "-" "-" rt=0.002 ut="-" cs=-
58.49.59.142 - - [06/Nov/2011:12:23:27 +0800] "GET / HTTP/1.1" 499 0 "-" "-" "-" rt=0.000 ut="-" cs=-
202.201.252.2 - - [06/Nov/2011:12:23:27 +0800] "GET / HTTP/1.1" 499 0 "-" "-" "-" rt=0.000 ut="-" cs=-
202.201.252.2 - - [06/Nov/2011:12:23:27 +0800] "GET / HTTP/1.1" 499 0 "-" "-" "-" rt=0.000 ut="-" cs=-
119.147.86.178 - - [06/Nov/2011:12:23:27 +0800] "GET / HTTP/1.1" 499 0 "-" "-" "-" rt=0.000 ut="-" cs=-
58.221.37.82 - - [06/Nov/2011:12:23:27 +0800] "GET / HTTP/1.1" 499 0 "-" "-" "-" rt=0.039 ut="-" cs=-
222.189.237.18 - - [06/Nov/2011:12:23:27 +0800] "GET / HTTP/1.1" 499 0 "-" "-" "-" rt=0.001 ut="-" cs=-
58.49.59.142 - - [06/Nov/2011:12:23:27 +0800] "GET / HTTP/1.1" 499 0 "-" "-" "-" rt=0.000 ut="-" cs=-
58.49.59.142 - - [06/Nov/2011:12:23:27 +0800] "GET / HTTP/1.1" 499 0 "-" "-" "-" rt=0.045 ut="-" cs=-
119.147.86.178 - - [06/Nov/2011:12:23:27 +0800] "GET / HTTP/1.1" 499 0 "-" "-" "-" rt=0.036 ut="-" cs=-
222.189.237.18 - - [06/Nov/2011:12:23:27 +0800] "GET / HTTP/1.1" 499 0 "-" "-" "-" rt=0.000 ut="-" cs=-
222.189.237.18 - - [06/Nov/2011:12:23:27 +0800] "GET / HTTP/1.1" 499 0 "-" "-" "-" rt=0.037 ut="-" cs=-
222.215.105.135 - - [06/Nov/2011:12:23:27 +0800] "GET / HTTP/1.1" 499 0 "-" "-" "-" rt=0.000 ut="-" cs=-

400～500间的错误码仅定义到了417，所以499应该是nginx自己定义的。

读读nginx代码，看一下注释，找到src/http/ngx_http_special_response.c 这个文件328行，里面定义了不少http错误码以及相应的返回。注意到有下面这样的注释：


    ngx_string(ngx_http_error_494_page), /* 494, request header too large */
    ngx_string(ngx_http_error_495_page), /* 495, https certificate error */
    ngx_string(ngx_http_error_496_page), /* 496, https no certificate */
    ngx_string(ngx_http_error_497_page), /* 497, http to https */
    ngx_string(ngx_http_error_404_page), /* 498, canceled */
    ngx_null_string,                     /* 499, client has closed connection */

    ngx_string(ngx_http_error_494_page), /* 494, request header too large */
    ngx_string(ngx_http_error_495_page), /* 495, https certificate error */
    ngx_string(ngx_http_error_496_page), /* 496, https no certificate */
    ngx_string(ngx_http_error_497_page), /* 497, http to https */
    ngx_string(ngx_http_error_404_page), /* 498, canceled */
    ngx_null_string,                     /* 499, client has closed connection */
可以看到，499对应的是 “client has closed connection”。这很有可能是因为服务器端处理的时间过长，客户端“不耐烦”了。要解决此问题，就需要在程序上面做些优化了。

除了499，nginx还定义了495/496/497/498 这几个Status Codes，相应的意义也在上面的注释中可以看到。开源的东西，可以随时翻看源码，这一点很棒。


来自：http://blog.hexu.org/archives/1085.shtml ]]> http://jackxiang.com/post//#blogcomment <user@domain.com> Thu, 01 Jan 1970 00:00:00 +0000 http://jackxiang.com/post//#blogcomment