Getting Data In

What kind of log is this (from Proxy access logs)

aaronnicoli
Path Finder

Hi all,

I'm trying to identify what this is in my access logs:

POST http://123.123.123.123/open/1

Followed by thousands of:

POST http://123.123.123.123/IVmYwvJKhJFesFjK/1001
POST http://123.123.123.123/IVmYwvJKhJFesFjK/1002
POST http://123.123.123.123/IVmYwvJKhJFesFjK/1003
...

Obviously the actual IP is omitted (pub internet address).

Your help would make my day!

Thanks all

0 Karma
1 Solution

dperre_splunk
Splunk Employee
Splunk Employee

Whilst I can't be sure what this is the following link looks very similar to what your logs are saying.
https://en.wikipedia.org/wiki/Real-Time_Messaging_Protocol

*

HTTP tunneling
In RTMP Tunneled (RTMPT), RTMP data is encapsulated and exchanged via HTTP, and messages from the client (the media player, in this case) are addressed to port 80 (the default for HTTP) on the server.
While the messages in RTMPT are larger than the equivalent non-tunneled RTMP messages due to HTTP headers, RTMPT may facilitate the use of RTMP in scenarios where the use of non-tunneled RTMP would otherwise not be possible, such as when the client is behind a firewall that blocks non-HTTP and non-HTTPS outbound traffic.
The protocol works by sending commands through the POST URL, and AMF messages through the POST body. An example is
POST /open/1 HTTP/1.1
for a connection to be opened.

View solution in original post

dperre_splunk
Splunk Employee
Splunk Employee

Whilst I can't be sure what this is the following link looks very similar to what your logs are saying.
https://en.wikipedia.org/wiki/Real-Time_Messaging_Protocol

*

HTTP tunneling
In RTMP Tunneled (RTMPT), RTMP data is encapsulated and exchanged via HTTP, and messages from the client (the media player, in this case) are addressed to port 80 (the default for HTTP) on the server.
While the messages in RTMPT are larger than the equivalent non-tunneled RTMP messages due to HTTP headers, RTMPT may facilitate the use of RTMP in scenarios where the use of non-tunneled RTMP would otherwise not be possible, such as when the client is behind a firewall that blocks non-HTTP and non-HTTPS outbound traffic.
The protocol works by sending commands through the POST URL, and AMF messages through the POST body. An example is
POST /open/1 HTTP/1.1
for a connection to be opened.

View solution in original post

aaronnicoli
Path Finder

Thank you!

That's steered me in the right direction.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!