Wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.

====== PFSense - Suricata - Alerts - ET SCAN Internal Dummy Connection User-Agent Inbound ======

When the Apache HTTP Server manages its child processes, it needs a way to wake up processes that are listening for new connections.

  * To do this, it sends a simple HTTP request back to itself.
  * This request will appear in the access_log file with the remote address set to the loop-back interface (typically 127.0.0.1 or ::1 if IPv6 is configured).
  * If you log the User-Agent string you will see the server signature followed by **(internal dummy connection)** on non-SSL servers.
  * During certain periods you may see up to one such request for each httpd child process.
  * These requests are perfectly normal and you do not, in general, need to worry about them.  They can simply be ignored.

If however these come from outside the local network, then usually a trojin, so continue blocking.

----