GET /wpad.dat entries flooding my access_log

Posted by Aas on Server Fault See other posts from Server Fault or by Aas
Published on 2014-06-02T09:15:55Z Indexed on 2014/06/02 9:29 UTC
Read the original article Hit count: 710

Filed under:

log-files

|

flooding

|

wpad.dat

|

wpad

I have a small LAN of some 30 users in it with proxy auto configuration enabled and working.

Two of them are requesting wpad.dat file too rapidly at a pace of 30 times per second.

10.1.14.246 - - [02/Jun/2014:09:07:18 +0200] "GET /wpad.dat HTTP/1.1" 302 302
10.1.14.141 - - [02/Jun/2014:09:07:18 +0200] "GET /wpad.dat HTTP/1.1" 302 302

I don't know whether this is a problem from performance perspective, (the server is powerful enough to handle this) but the problem is it clogs up the access_log file. It grows about 1GB per week.

Clients run Win7Pro. What could cause this behavior? What can be done to stop it? I have shortened log rotate window as a temporary workaround to prevent /var fill up.

Thanks beforehand for your support.

© Server Fault or respective owner

Related posts about log-files

Problem with squid log files

as seen on Server Fault - Search for 'Server Fault'
I am using SARG to get a report on the squid log files, I get this result /usr/local/Sarg/bin/sarg -l /usr/local/squid/var/logs/access.log SARG: Records in file: 0, reading: 0.00% SARG: Records in file: 0, reading: 0.00% SARG: Records in file: 0, reading: 0.00% SARG: Records in file: 0, reading:… >>> More
Safe to enable compression C:\WINDOWS\system32\LogFiles

as seen on Server Fault - Search for 'Server Fault'
Will it slow down my website if I enable compression on the C:\WINDOWS\system32\LogFiles directory? These files are slowly but surely chewing away drive space and I'd like to slow the expansion. I'm worried however that this will also slow my websites. >>> More
My linux server time and log files are not the same

as seen on Server Fault - Search for 'Server Fault'
Hi i have installed NTP on my linux server and i am getting my clock from a 6500 core switch, everything is working fine. When i ssh to a switch i have it all sent to a log file on the linux server, this log file does not time stamp with the same time as i have on the server. the date and hwclock… >>> More
Minimizing SQL transaction log file size on developer box running simple recovery model

as seen on Server Fault - Search for 'Server Fault'
We have alot of SQL servers on development environment where we never take backup of the databases (TFS for code is enough). The (SharePoint) databases are all set to simple recovery model, but the log files, especially for the SharePoint configuration database is growing quite large and filling… >>> More
How to write to Tomcat log files

as seen on Stack Overflow - Search for 'Stack Overflow'
What is the easiest way to print out something in a Tomcat Log file. I was under the impression that System.out.println() would print to one of the log files. I just want to print out the value of a string, so the simplest solution would be best. If there is no simple/trivial solution I guess I… >>> More

Related posts about flooding

How does ospf control flooding?

as seen on Server Fault - Search for 'Server Fault'
What method is used by ospf protocol to prevent looping of flooded packets for link state advertisements? The packet header does not contain any timestamp. How do the routers recognize that it is the same advertisement that they sent before? >>> More
how does ospf control flooding?

as seen on Super User - Search for 'Super User'
what method is used by ospf protocol to prevent looping of flooded packets for link state advertisements? The packet header does not contain any timestamp. How do the routers recognize that it is the same advertisement that they sent before? >>> More
Ping flood attack every 5 seconds

as seen on Super User - Search for 'Super User'
My router's log, which is a D-Link DIR-600, shows 40 pages (and updating) of entries like: Nov 19 11:17:08 PING-FLOODING flooding attack from WAN (ip:85.250.85.11) detected. Nov 19 11:17:02 PING-FLOODING flooding attack from WAN (ip:85.131.129.176) detected. Nov 19 11:16:57 PING-FLOODING… >>> More
Supercharge Your Website and See Traffic Flooding at Your Door

as seen on Ezine Articles - Search for 'Ezine Articles'
Thanks to your tips and tactics, my website is supercharged and I have more visitors than I can handle (of course he is able to handle), exclaimed my friend when I entered his home for the super success party that he threw. It was not long ago when after losing his job to the economic meltdown, he… >>> More
Why does ping flooding a domain name freezes and not a direct ip address

as seen on Server Fault - Search for 'Server Fault'
I am wondering why, when ping flooding a domain, the ping flood freezes after a couple of seconds then continues and this freeze, unfreeze continues until i stop the ping flood. When i do the same using the ip it does not freeze. NEVER. i did for example sudo ping -f IP (It does not freeze) then… >>> More