501.shtml errors on Apache?

501.shtml errors

[jebernier]

On my VPS server hosted at GreenGeeks I'm getting the following errors that GreenGeeks said is causing Apache to restart:

file does not exist /usr/local/apache/htdocs/501.shtml
Invalid method in request \x16\x03\x01

The thing is, that these requests are coming from our own Corporate Network IP's! along with other misc. Ip's

1) Are these normal requests?
2) Why are they coming from our own Corporate IP's?
3) How do I prevent them without blocking all internal employees from viewing our websites?

Note: I'm not the network admin, just the webmaster and the network admin said there are no virus or malware on anyone's PC's.

Thanks-in-Advance

[not2easy]

A 501 is a server response that means that the server could not complete the request. Your httpd.conf file may have referenced a 501.shtml file that does not exist but your network admin should be able to find the cause (the request). Given the information you've shared here, it looks more like a configuration error than malware.

[lucy24]

file does not exist /usr/local/apache/htdocs/501.shtml

You forgot to say whether it's true that the file doesn't exist.

Is this a line from your error logs? If so, it's probably tangential to the real problem; it simply means that a 501 occurred and the server is then looking for-- and not finding-- a "501.shtml" error document to send out instead. (Idle query: why would you use SSIs on a 500-class error, as implied by the .shtml extension? Seems like you'd want to keep things as simple as possible when you already know the server is having trouble.) If you don't have one, and this is a VPS, where's the server finding the ErrorDocument directive?

GreenGeeks said is causing Apache to restart

Again: are they correct in saying this? I think error logs will show timestamps for every server restart.

:: wandering off to refresh memory on 501s, since I'm much more familiar with 503 ::

Right, it goes with the other quoted line

Invalid method in request \x16\x03\x01

What's behind those hex codes? Does the server have a cat?

[jebernier]

Just wondering if there is anyway to prevent these. Looks like bot traffic. Guess the only way is to block the IP's

[lucy24]

the only way is to block the IP's

If they're known robotic IPs, that's probably your first choice anyway. (Does a 403 in this situation trump a 501? I'm hazy on the hierarchy of responses when it's 400-class vs. 500-class.)