Getting Data In

What kind of log is this (from Proxy access logs)

Path Finder

Hi all,

I'm trying to identify what this is in my access logs:

POST http://123.123.123.123/open/1

Followed by thousands of:

POST http://123.123.123.123/IVmYwvJKhJFesFjK/1001
POST http://123.123.123.123/IVmYwvJKhJFesFjK/1002
POST http://123.123.123.123/IVmYwvJKhJFesFjK/1003
...

Obviously the actual IP is omitted (pub internet address).

Your help would make my day!

Thanks all

0 Karma
1 Solution

Splunk Employee
Splunk Employee

Whilst I can't be sure what this is the following link looks very similar to what your logs are saying.
https://en.wikipedia.org/wiki/Real-Time_Messaging_Protocol

*

HTTP tunneling
In RTMP Tunneled (RTMPT), RTMP data is encapsulated and exchanged via HTTP, and messages from the client (the media player, in this case) are addressed to port 80 (the default for HTTP) on the server.
While the messages in RTMPT are larger than the equivalent non-tunneled RTMP messages due to HTTP headers, RTMPT may facilitate the use of RTMP in scenarios where the use of non-tunneled RTMP would otherwise not be possible, such as when the client is behind a firewall that blocks non-HTTP and non-HTTPS outbound traffic.
The protocol works by sending commands through the POST URL, and AMF messages through the POST body. An example is
POST /open/1 HTTP/1.1
for a connection to be opened.

View solution in original post

Splunk Employee
Splunk Employee

Whilst I can't be sure what this is the following link looks very similar to what your logs are saying.
https://en.wikipedia.org/wiki/Real-Time_Messaging_Protocol

*

HTTP tunneling
In RTMP Tunneled (RTMPT), RTMP data is encapsulated and exchanged via HTTP, and messages from the client (the media player, in this case) are addressed to port 80 (the default for HTTP) on the server.
While the messages in RTMPT are larger than the equivalent non-tunneled RTMP messages due to HTTP headers, RTMPT may facilitate the use of RTMP in scenarios where the use of non-tunneled RTMP would otherwise not be possible, such as when the client is behind a firewall that blocks non-HTTP and non-HTTPS outbound traffic.
The protocol works by sending commands through the POST URL, and AMF messages through the POST body. An example is
POST /open/1 HTTP/1.1
for a connection to be opened.

View solution in original post

Path Finder

Thank you!

That's steered me in the right direction.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!