What kind of log is this (from Proxy access logs)

[aaronnicoli]

Hi all,

I'm trying to identify what this is in my access logs:

POST http://123.123.123.123/open/1

Followed by thousands of:

POST http://123.123.123.123/IVmYwvJKhJFesFjK/1001
POST http://123.123.123.123/IVmYwvJKhJFesFjK/1002
POST http://123.123.123.123/IVmYwvJKhJFesFjK/1003
...

Obviously the actual IP is omitted (pub internet address).

Your help would make my day!

Thanks all

[dperre_splunk · Accepted solution]

Whilst I can't be sure what this is the following link looks very similar to what your logs are saying.
https://en.wikipedia.org/wiki/Real-Time_Messaging_Protocol

*

HTTP tunneling
In RTMP Tunneled (RTMPT), RTMP data is encapsulated and exchanged via HTTP, and messages from the client (the media player, in this case) are addressed to port 80 (the default for HTTP) on the server.
While the messages in RTMPT are larger than the equivalent non-tunneled RTMP messages due to HTTP headers, RTMPT may facilitate the use of RTMP in scenarios where the use of non-tunneled RTMP would otherwise not be possible, such as when the client is behind a firewall that blocks non-HTTP and non-HTTPS outbound traffic.
The protocol works by sending commands through the POST URL, and AMF messages through the POST body. An example is
POST /open/1 HTTP/1.1
for a connection to be opened.

[aaronnicoli]

Thank you!

That's steered me in the right direction.