topic Re: What kind of log is this (from Proxy access logs) in Getting Data In

What kind of log is this (from Proxy access logs)

aaronnicoli — Tue, 06 Sep 2016 02:01:36 GMT

Hi all,

I'm trying to identify what this is in my access logs:

POST http://123.123.123.123/open/1

Followed by thousands of:

POST http://123.123.123.123/IVmYwvJKhJFesFjK/1001
POST http://123.123.123.123/IVmYwvJKhJFesFjK/1002
POST http://123.123.123.123/IVmYwvJKhJFesFjK/1003
...

Obviously the actual IP is omitted (pub internet address).

Your help would make my day!

Thanks all

Re: What kind of log is this (from Proxy access logs)

dperre_splunk — Mon, 03 Oct 2016 01:43:27 GMT

Whilst I can't be sure what this is the following link looks very similar to what your logs are saying.
https://en.wikipedia.org/wiki/Real-Time_Messaging_Protocol

HTTP tunneling
In RTMP Tunneled (RTMPT), RTMP data is encapsulated and exchanged via HTTP, and messages from the client (the media player, in this case) are addressed to port 80 (the default for HTTP) on the server.
While the messages in RTMPT are larger than the equivalent non-tunneled RTMP messages due to HTTP headers, RTMPT may facilitate the use of RTMP in scenarios where the use of non-tunneled RTMP would otherwise not be possible, such as when the client is behind a firewall that blocks non-HTTP and non-HTTPS outbound traffic.
The protocol works by sending commands through the POST URL, and AMF messages through the POST body. An example is
POST /open/1 HTTP/1.1
for a connection to be opened.

Re: What kind of log is this (from Proxy access logs)

aaronnicoli — Mon, 03 Oct 2016 21:11:45 GMT

Thank you!

That's steered me in the right direction.