106 reputation
3
bio website
location Michigan
age 45
visits member for 1 year, 10 months
seen Sep 16 '12 at 0:34

Andy Holaday is the Actuarial Data Manager at AFHI, the largest non-governmental specialty writer of workers compensation insurance in the United States.

His specialties include applying acute understanding of business requirements to generate data requirements, analysis, acquiring and providing quality data for others, data presentation and visualization, and creating sustainable data architecture.

His passion is adding value with comprehensive analysis, creating data-driven solutions for end-users at all levels of experience, and crafting and improving repeatable workflows.

Favorite database technologies include Oracle and SQL Server.


Jun
30
comment Apache (XAMPP 1.8.0) access.log/Intrusion Detection Concern
Adding... Server Fault is not for Anything in a home setting, but my question is in a home setting.
Jun
30
comment Apache (XAMPP 1.8.0) access.log/Intrusion Detection Concern
I appreciate you sticking with me through the comments. The routers are configured with DHCP generally speaking, but in order to direct HTTP traffic to my server RouterB and the web server have fixed IPs on the LAN. The routers use port forwarding to direct HTTP traffic to the server.
Jun
30
comment Apache (XAMPP 1.8.0) access.log/Intrusion Detection Concern
(In previous comment that should be 403 errors. Sorry about that typo.) I set up another test using a script to send 50 GET requests in rapid succession from an external network. The server log shows all originating from the external IP. IOW, I cannot replicate the source IP changing to private address 192.15.X.X. <<still mystified>>
Jun
28
comment Apache (XAMPP 1.8.0) access.log/Intrusion Detection Concern
Test 2: From my phone, I bombarded my server with GET requests for phpMyAdmin. All I get in the logs is a steady stream of 203 errors, with no change in source IP, so this is inconclusive. It does occur to me though, that 192.168.15.3 is not on the server's network, and Apache is set up to deny file system access in that case. None of this really answers the questions though, so I am leaving open.
Jun
28
comment Apache (XAMPP 1.8.0) access.log/Intrusion Detection Concern
Test 1: I set up WireShark to record inbound HTTP requests and as luck (?) would have it, I trapped this exact scenario from a different IP. It is interesting to look at, but doesn't answer any questions. Half-way through the hit list the source IP changes from x.x.x.x to 192.168.15.3 for no apparent reason. [continues...]
Jun
28
awarded  Student
Jun
28
awarded  Citizen Patrol
Jun
28
awarded  Supporter
Jun
28
comment Apache (XAMPP 1.8.0) access.log/Intrusion Detection Concern
Thanks for the ideas and suggestions. I will try these. I had not thought of using WireShark to log traffic. I will follow-up after my tests.
Jun
27
comment Apache (XAMPP 1.8.0) access.log/Intrusion Detection Concern
Thanks for the response. I can pretty confidently say this is not an internal attack, and I routinely deny high-volume scan addresses in httpd.conf. FWIW my network architecture has two routers: Internet <-> RouterA <-> RouterB <-> many local devices. RouterA directs HTTP traffic to RouterB, which in turn directs to localhost. 192.168.15.3 is the WAN address of RouterB. Maybe RouterB is just getting confused?
Jun
27
asked Apache (XAMPP 1.8.0) access.log/Intrusion Detection Concern