The magical 'Error 400 - Bad Request'

Forums › New Zealand Broadband › The magical 'Error 400 - Bad Request'

foobar

186 posts

Master Geek

#17775 11-Dec-2007 12:08

Hello!

I keep encountering this very strange symptom: Ever now and then, sometimes in spurts, I get an 'Error 400 - Bad Request' in my web-browser (Firefox on Linux).

This happens for completely different web-sites, and the error (and its HTML code) always looks exactly the same:

Error 400 - Bad Request

A couple of strange things about this:

I can see this no matter which ISP I am using here in New Zealand (I used to be a Telecom Xtra customer, now I'm with Xnet, and currently, I'm with Cafenet in some public hotspot).
I am not running any proxy software myself.
I am not seeing this when I am travelling in the US or Europe.
Pressing reload a couple of times tends to eventually 'break through' and gets me a proper page load.
As mentioned: This is completely independent of the web-site that I'm using: When I'm in one of those 'spurts', I may get this error on requests going to a number of different web-sites.

What's going on here? Is there some country-wide proxy of sorts, which is having capacity problems? Does anyone else see this?

The blog: foobar on computers, software and the rest of the world: http://www.geekzone.co.nz/foobar

SamF

1598 posts

Uber Geek
+1 received by user: 252

Trusted

#99419 11-Dec-2007 12:53

I'd be looking a bit more 'locally' for the cause if I were you... (assuming all these issues are happening on the same machine).
First up, a spyware scan (spybot is a good one - http://www.safer-networking.org) & update your AV software (or use the excellent & FREE! AVG software - http://free.grisoft.com). I would recommend REMOVING any Symantec 'AV' product as IMNSHO they just don't work properly - I've removed a fully up-to-date 'working' SAV install, put AVG on and found 100+ DIFFERENT viruses!!!

If none of that works, it might be time to look at a re-install of the OS.

The other possiblity is that you have some kind of network hardware issue, so I'd start a continuous ping test to a LAN IP & monitor it for dropouts when you get your Internet issue. In addition, testing while connected via a hard-wired network connection might be a good idea as well.

Let me know how you go!

freitasm

BDFL - Memuneh
80658 posts

Uber Geek
+1 received by user: 41071

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#99422 11-Dec-2007 12:59

On Linux?

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

foobar

186 posts

Master Geek

#99423 11-Dec-2007 12:59

SamF: I'd be looking a bit more 'locally' for the cause if I were you... (assuming all these issues are happening on the same machine).

Yes, that was my thought as well. "Must be my problem." But see below.

First up, a spyware scan (spybot is a good one - http://www.safer-networking.org) & update your AV software (or use the excellent & FREE! AVG software - http://free.grisoft.com). I would recommend REMOVING any Symantec 'AV' product as IMNSHO they just don't work properly - I've removed a fully up-to-date 'working' SAV install, put AVG on and found 100+ DIFFERENT viruses!!!

Hm. I'm using Linux. Therefore, I don't use any of those pieces of software.

If none of that works, it might be time to look at a re-install of the OS.

I'm trying something along those lines right now.

The other possiblity is that you have some kind of network hardware issue, so I'd start a continuous ping test to a LAN IP & monitor it for dropouts when you get your Internet issue. In addition, testing while connected via a hard-wired network connection might be a good idea as well.

Yeah, so as I said: The only thing in common here is my laptop. I don't run any proxy software, though, which could be the culprit. My network equipment is definitely not the issue, since the same problem appears while I am using someone else's network. I'm using the public Cafenet network right now, definitely not in my home. I have seen the problem with Telecom and Xnet in my home, and I keep seeing it while I am using a public hotspot. So, it's not my network equipment either.

The blog: foobar on computers, software and the rest of the world: http://www.geekzone.co.nz/foobar

foobar

186 posts

Master Geek

#99432 11-Dec-2007 13:54

Some more information. I looked at the packets and exchanged request headers with Wireshark, but also with the TemperData extension in Firefox.

Turns out that whenever the 400 error happens, there is something that they have in common, no matter which site I visit. It seems to have something to do with Yahoo's Geocities, even though the sites that I am visiting are unlikely to all be hosted there, which is very odd.

In TemperData I can see the sent request headers, and the received response headers. Here is the set of request headers for one of the many cases in which I see this:

Host=pycheesecake.org
User-Agent=Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.11) Gecko/20061201 Firefox/2.0.0.11 (Ubuntu-feisty)
Accept=text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language=en-us,en;q=0.5
Accept-Encoding=gzip,deflate
Accept-Charset=ISO-8859-1,utf-8;q=0.7,*;q=0.7
Connection=close
Cookie=BX=evcr6jd3lrnkf&b=3&s=tb
If-Modified-Since=Thu, 01 Jun 2006 19:47:58 GMT
If-None-Match="13d5c-8c-447f446e"
Cache-Control=max-age=0

And here is the set of response headers:

Status=Bad Request - 400
Date=Tue, 11 Dec 2007 00:49:39 GMT
P3P=policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
X-Host=p8w14.geo.mud.yahoo.com
X-INKT-URI=http://us.geocities.com/server-errors/pd_bad_request.html
X-INKT-SITE=http://us.geocities.com/server-errors
Last-Modified=Thu, 01 Jun 2006 19:47:58 GMT
Etag="13d5c-8c-447f446e"
Accept-Ranges=bytes
Content-Length=194
Connection=close
Content-Type=text/html

Then I wait for a while, reload a couple of times, and finally it will work. The response headers (to the very same request, and without any redirects or anything else!) then look like this:

Status=Ok - 200
Date=Tue, 11 Dec 2007 00:51:30 GMT
Server=Apache/2.2.3 (Debian) DAV/2 SVN/1.4.2 mod_scgi/1.11
Cache-Control=must-revalidate
Expires=Fri, 01 Jan 1999 00:00:00 GMT
Set-Cookie=trac_session=a84ddc5afbde1bf08df2b47e; expires=Mon, 10-Mar-2008 00:51:30 GMT;
Content-Length=44773
Connection=close
Content-Type=text/html;charset=utf-8

What is going on?

Note that the response headers in case of the 400 error look the same, no matter which site I visit (if it happens). The only difference is that the X-Host may indicate something like p8w4, rather than p8w14, for exxample. Or the Etag is different. Other than that, it's all exactly the same.

The blog: foobar on computers, software and the rest of the world: http://www.geekzone.co.nz/foobar

SamF

1598 posts

Uber Geek
+1 received by user: 252

Trusted

#99597 12-Dec-2007 12:23

Sorry, sorry, my bad, missed the 'Linux' bit :D

This is still very odd, especially the 'geocities' references in the headers. You've not got a Yahoo toolbar installed on all your browsers have you?

Still sounds like either a plugin / other software / spyware to me (not sure how common spyware is in Linux, but there's always a first!)

foobar

186 posts

Master Geek

#99599 12-Dec-2007 12:31

SamF:
This is still very odd, especially the 'geocities' references in the headers. You've not got a Yahoo toolbar installed on all your browsers have you?

Still sounds like either a plugin / other software / spyware to me (not sure how common spyware is in Linux, but there's always a first!)

No, I don't have a Yahoo toolbar. And what's most interesting: I got the problem a lot yesterday when I had to use Cafenet for browsing. Now that I'm back home I'm seeing uit much less often. And when I'm out of the country (with my laptop) I don't see it at all!

The blog: foobar on computers, software and the rest of the world: http://www.geekzone.co.nz/foobar