<html> <head> <meta http-equiv="content-type" content="text/html; charset=utf-8"> </head> <body text="#000000" bgcolor="#FFFFFF"> Since I updated httpd on RHEL 6 to the current version of httpd-2.2.15-60.el6_9.6.x86_64, the access log shows numerous entries of this kind <tt>client-ip TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [20/Jul/2018:00:00:15 +0200] "-" 408 - host:- "-" 59002 458</tt><tt> </tt><tt>client-ip TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [20/Jul/2018:00:00:15 +0200] "-" 408 - host:- "-" 41504 456</tt><tt> </tt><tt>client-ip TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [20/Jul/2018:00:00:15 +0200] "-" 408 - host:- "-" 54741 417</tt><tt> </tt><tt>client-ip TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [20/Jul/2018:00:00:15 +0200] "-" 408 - host:- "-" 24221 435</tt><tt> </tt><tt>client-ip TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [20/Jul/2018:00:00:15 +0200] "-" 408 - host:- "-" 54909 402</tt><tt> </tt><tt>client-ip TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [20/Jul/2018:00:00:15 +0200] "-" 408 - host:- "-" - 23617 481</tt><tt> </tt><tt>client-ip TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [20/Jul/2018:00:00:25 +0200] "-" 408 - host:- "-" - 26895 1149</tt><tt> </tt><tt>client-ip - - [20/Jul/2018:00:00:27 +0200] "-" 408 - host:- "-" - 10038 529</tt><tt> </tt><tt>client-ip TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [20/Jul/2018:00:00:27 +0200] "-" 408 - host:- "-" - 23180 491</tt><tt> </tt><tt>client-ip - - [20/Jul/2018:00:00:29 +0200] "-" 408 - host:- "-" - 21645 505</tt><tt> </tt><tt>client-ip TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [20/Jul/2018:00:00:29 +0200] "-" 408 - host:- "-" - 26958 1442</tt><tt> </tt><tt>client-ip TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [20/Jul/2018:00:00:30 +0200] "-" 408 - host:- "-" 62830 477</tt><tt> </tt><tt>client-ip - - [20/Jul/2018:00:00:35 +0200] "-" 408 - host:- "-" 63647 536</tt><tt> </tt><tt>client-ip - - [20/Jul/2018:00:00:43 +0200] "-" 408 - host:- "-" - 5931 427</tt><tt> </tt><tt>client-ip TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [20/Jul/2018:00:00:49 +0200] "-" 408 - host:- "-" 64166 495</tt><tt> </tt><tt>client-ip - - [20/Jul/2018:00:00:51 +0200] "-" 408 - host:- "-" 4119 1310</tt><tt> </tt><tt>client-ip TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [20/Jul/2018:00:00:57 +0200] "-" 408 - host:- "-" - 32361 32571</tt><tt> </tt><tt>client-ip TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [20/Jul/2018:00:01:00 +0200] "-" 408 - host:- "-" - 1403 444</tt><tt> </tt><tt>client-ip TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [20/Jul/2018:00:01:00 +0200] "-" 408 - host:- "-" - 13066 464</tt><tt> </tt><tt>client-ip TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [20/Jul/2018:00:01:00 +0200] "-" 408 - host:- "-" - 8790 443</tt><tt> </tt><tt>client-ip TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [20/Jul/2018:00:01:06 +0200] "-" 408 - host:- "-" - 14043 420</tt><tt> </tt><tt>client-ip TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [20/Jul/2018:00:01:06 +0200] "-" 408 - host:- "-" - 340 429</tt><tt> </tt><tt>client-ip TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 [20/Jul/2018:00:01:06 +0200] "-" 408 - host:- "-" - 22188 436</tt><tt> </tt><tt>client-ip TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 [20/Jul/2018:00:01:11 +0200] "-" 408 - host:- "-" - 26015 614</tt> both on http and https connections. They often appear in batches of around 6 such requests from the same IP, within very few seconds. What does that indicate? Why did it not exist before apache httpd-2.2.15-60.el6_9.6.x86_64, The previous version was httpd-2.2.15-59.el6.x86_64 My yum.log shows that the 408 log entries started exactly with the installation of the current version. </body> </html>