http-headers - 来自某些客户端的 HTTP header 随机替换了字符

Question

进行网络流量和日志分析，但从客户端传递了很多格式错误的 header 。这些字符被换位或替换为“x”。

有谁知道他们来自哪里或为什么？这是某种安全尝试，还是更邪恶的事情？

例子:

xroxy-connection: Keep-Alivecneoction: closenncoection: closeocpry-connection: Keep-Alivepxyro-connection: closeproxy-~~~~~~~~~~: ~~~~~~~~~~x-xorwarded-for: 000.00.00.000Referer: http://www.example.xom/nxws/article/2009-1x-21/?cid=4xxx00x2-0x60x3x0

Answer 1

查看 Fun With HTTP Headers 的 Missed Cneonctions 部分.作者认为:

I now believe this is something done by a hackish hardware load balancer trying to “remove” the connection close header when proxying for an internal server. That way, the connection can be held open and images can be transmitted through the same TCP connection, while the backend web server doesn’t need to be modified at all.