IIS6 lost packets - iis

We've had an issue on and off for some time now...
We have an app which sync's to a server, we know the request is getting to the server as we have been running wireshark and can see the incoming request.
Now this is where I need some correcting if im wrong somewhere...
my understanding is that the traffic will go from the network card on the machine, to HTTP.sys, which forwards it to IIS6, which then sends it to my executable ISAPI, which in turn provides the response which goes back through IIS6, through the network card over the WWW back to the device.
Now these requests that are going missing, like I said we can see that the request has got to the network card thanks to wireshark, but we don't know what's happened to it from this point, there's no error in the HTTP.sys log, and nothing in the IIS log, same with the log for our ISAPI, nothing in here either.
The fact that the HTTP.sys log is empty indicates to me that the kernal thinks it has successfully passed it onto IIS6, but I dont know if IIS6 logs when it first receives the request, or once it has successfully responded to it, has anyone got any ideas on this one? its a very strange one.

Related

How did an IP send Get requests to my code?

I am new to web development. I am developing a flask web server on my linode linux web server on port 5000. I got this output from an unknown ip. I researched the ip and found out that this is a whitelisted IP address and is "harmless", but I dont know. It looks like it sent GET requests to my cover photo, the javascript, the css, an icon on the page, and an unknown request. What does sending a GET request to these items even entail? I dont have any button or anything that sends a get request to these items. Whenever I am developing the web server while on port 5000 I am usually the only IP on the output. Additionally, this web server communicates with a raspberry pi over mqtt over the non-encrypted port 1883.
Again, I am new to this world and am wondering if anyone can help me decipher what this means that would be very helpful. In the meantime should I will configure the servers firewall to only allow requests from my computers ip to my server? Anyone think this is a reasonable next step or have any additional advice?
I believe what's happening is that your website is sending a GET request to retrieve those assets (e.g. your images) which are stored under your localhost address and the paths that you see in the console output.

Any Linux command to see the URL of file a process is downloading?

When a process is stuck in downloading a remote file(I can see from jstack that is is being blocked in socket read), is there any Linux command to tell what's the actual URL of the remote file that the process is downloading?
Tools like lsof seem only giving the remote host, instead of the path of particular remote files.
Considering that the client has already sent the HTTP request to the server and is now waiting for the response the exact URL requested is no longer available on the network. Nor is the URL available somewhere in sockets states because these deal only with network and transport layer information and not with application level information (i.e. HTTP). If you are lucky than you can find the original URL somewhere inside the memory of the application but since it is actually not needed any longer by the application (request has been sent) it might be, that it is not even known to the application any longer.

Mis-configured domain, causing 104 (connection reset by peer) error on heroku website

I have a misconfigured heroku website. It shows error 104 (Read Error: Connection reset by peer) upon typing its URL and hitting enter. But subsequently refreshing the URL a couple of times makes the URL load correctly (some kind of fallback kicks in? - not that I knowingly configured any). The URL is http://damadam.in/ (it's a naked domain).
I bought this domain from godaddy. In Godaddy's control panel where I have the DNS Zone file, the host www points to damadam.herokuapp.com (under CName). http://damadam.in is set to forward to http://www.damadam.in. Lastly, in my heroku control panel both http://damadam.in and http://www.damadam.in have damadam.herokuapp.com as the DNS target (could this last configuration be the problem)?
Can someone help me properly set this thing up?
This is not a http response code, but rather an error number indicating something was wrong with the connection.
"Connection reset by peer" means that, on the route from your computer to the final destination, a node decided to forcefully stop and reset the connection. On a configuration level I don't think you will be able to do much about this. If there was some kind of DNS misconfiguration, you would not see a read error, but a DNS Error instead.
Make sure that your local network is stable (e.g. connect to your modem with an ethernet cable, rather than through wifi). If this connection is stable, try again at a later date. Connections between nodes can break, and in some cases not all traffic might be able to reach the intended destination. If behaviour persists through a greater length of time, contact your host, in this case Godaddy, and ask them to look into this problem. It might be just a faulty piece of equipment

Monitoring outbound server http header information?

What tool / function can we use on our linux server running CentOS to monitor the http headers that are sent from our application to another application on a different server? Looking for http header monitoring from server to server. My issue is I have no idea how to capture the data sent from the server, meaning the http headers sent via a post. I have tried many methods and third party software's like fiddler2 and ieinspector and the list goes on, but they only seem to capture the client headers and not what is being sent out from the server. I just need to capture the string being sent out via a post function and what is being returned. Seems simple, yet in this case, I'm beyond lost and running out of time to resolve what should be a simple solution. Please advise & thank you kindly.

Routing requests from IIS to Jetty with isapi_redirect (tomcat connector)

I have installed the isapi_redirect into IIS, and allowed to run.
I have enabled the ajp13 in Jetty and I can telnet to port 8009.
This is my current uiworkermap.properties:
/hudson=jetty
/hudson/*=jetty
If I make a request to "http://localhost/hudson" or any subdirectory I get a 404 error.
All the other urls return the site defined in IIS.
This tells me that the isapi_redirect is looking at the uiworkermap file and trying to redirect correctly.
In the Jetty log and in the isapi_redirect log I don't see any errors.
If I go to http://localhost:8008/hudson I see it correctly.
Do you have any idea what could cause this?
UPDATE: I created a virtual directory with name "Jakarta" that pointed to the isapi_redirect dll like it is said here: http://tomcat.apache.org/connectors-doc/webserver_howto/iis.html
After this step the error changed, now in the browser I see:
Bad Gateway!
There is a problem with the page you are looking for, and it cannot be displayed. When the Web server (while acting as a gateway or proxy) contacted the upstream content server, it received an invalid response from the content server.
Jakarta/ISAPI/isapi_redirector/1.2.32 ()
In the error log (in debug mode) I can see that it first connects and the request is made but there is no response from jetty, and this error is generated:
[error] ajp_get_reply::jk_ajp_common.c (2118): (jetty) Tomcat is down or refused connection. No response has been sent to the client (yet)
This is the part of the log with the request and error:
https://rapidshare.com/files/3999719393/isapi_redirect_log.txt
Ok, in the end not having any help from stackoverflow users and also reading that in the official Jetty site about ajp13:
It is recommended to NOT use the AJP protocol, and superior
performance and clearer semantics will be achieve using HTTP.
I gave up on ajp and used a great and well documented open source dll to have HTTP proxy functions in IIS, IIRF.
So I would suggest anyone who has similar issues to just use an HTTP proxy instead.

Resources