Microsoft-WebDAV-MiniRedir/5.1.2600

help please

[thehittmann]

I'm getting around 50-100 OPTIONS / from Microsoft-WebDAV-MiniRedir/5.1.2600 a day. I've done dns searches on all of the IP's and they are all coming from my isp... this is not my IP so why am I getting these?

I am running 2003 server IIS and I have WebDAV prohibited.

[thehittmann]

Please anyone? I am getting hits from my isp ip's still with the /OPTIONS and also on /index.htm by the same ip's these ip's are not site surfers though because they never go further than the index page.

[wilderness]

Maybe nobody here has experienced the problems you are or nobody here uses WebDav?

Why not try providing further insight by submitting a couple of full log lines?

[thehittmann]

ok I do not use webdav either I have it set to prohibited in web server extensions

2005-06-14 14:31:46 OPTIONS / - - ***.245.117.6 Microsoft-WebDAV-MiniRedir/5.1.2600 - 200 0 0
2005-06-14 14:31:50 GET /index.htm - - ***.245.117.6 - - 200 0 64
2005-06-14 14:34:23 OPTIONS / - - ***.245.247.104 Microsoft-WebDAV-MiniRedir/5.1.2600 - 200 0 0
2005-06-14 14:50:37 OPTIONS / - - ***.245.247.104 Microsoft-WebDAV-MiniRedir/5.1.2600 - 200 0 0
2005-06-14 14:55:16 OPTIONS / - - ***.245.154.212 Microsoft-WebDAV-MiniRedir/5.1.2600 - 200 0 0
2005-06-14 14:59:15 OPTIONS / - - ***.245.117.6 Microsoft-WebDAV-MiniRedir/5.1.2600 - *** 0 0
2005-06-14 15:00:14 GET /index.htm - - ***.245.117.6 - - 200 0 64

All of the ip's resolve to my isp and often I see the get of the index.htm I'm still getting around 50-100 of these a day.

[bcolflesh]

Have you talked to your host? Could be a script they've setup to check the status of your index page.

[thehittmann]

I host my own server

[bcolflesh]

Ahh - what type of connection do you have? I've seen DAV requests on folk's machines that have domains enabled or drives shared - they occur when someone tries to make a "My Network Places" share mapped to one of your drives.

[wilderness]

ok I do not use webdav either I have it set to prohibited in web server extensions

I cannot tell you the why?
I can tell how to deny ;)

SetEnvIf User-Agent WebDAV
or
deny from ***.245.

BTW, those are not full logs, rather some scripted form of presented logs.

[thehittmann]

Ahh - what type of connection do you have? I've seen DAV requests on folk's machines that have domains enabled or drives shared - they occur when someone tries to make a "My Network Places" share mapped to one of your drives.

This makes a lot of sense. I have both enabled. domain for mail serving and i also have some shares on it that I acces regulary from this machine. I could deny the ip's but there is a whole heap of them and if I deny the whole *.245.x.x and the other group that I get I would also be banning myself seeing that my ip is in the same range.

[wilderness]

I would also be banning myself seeing that my ip is in the same range

With Mod_Rewrite you have the capability of denying or allowing IP ranges down to a single octet in the D class. Or even a small block of ranges.

Before you may implement such a small range deny, you would need to determine what ranges that you consistently use.
I'm sure it's not confined to xx.245.?
255 x 255 is a wide range of IP's for a solitary user.

ISP's have patterns in their IP range assignments. As a rule, they are not very broad and overall are fairly consistent.

[thehittmann]

I don't know if you read up there that I am using IIS not apache so I do not have mod_rewrite

[wilderness]

"IIS"

doesn't http conf off use of regex?

Don

[BrAiNee]

Hello there, i have the same trouble but it is only showing in my logs and error logs and it is Deny :) when you insert the following line in your http.conf

<Location />
<Limit PUT DELETE CONNECT OPTIONS PATCH PROPFIND PROPPATCH MKCOL COPY MOVE LOCK UNLOCK SEARCH>
Require valid-user
</Limit>
</Location>

have fun...

<Sorry, no personal URLs.
See Terms of Service [webmasterworld.com]>

[edited by: tedster at 7:05 pm (utc) on July 3, 2005]