Valid log entry?

...writing a log filter & want to know if this line is valid

[Jack_Hughes]

Can anybody tell me if the following line is valid or not . I know the request is pretty dodgy, but I want to know whether a log analyzer should discard it or not.

192.168.1.2 - - [14/Sep/2004:13:37:43 +0100] "SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1[this sequence carrios on for several k]\x90\x90\x90\x90\x90" 414 346 "-" "-"

I've shortened the request field and changed the IP address.

The thing I am interested in is the request field (the field starting with 'SEARCH'. Usually, it would have the request type (usually GET or POST) then the URI & then the protocol of the form HTTP/1.0 or HTTP/1.1. This one doesn't however. The protocol part is missed out completely.

Are the three parts to the request field mandatory? Or, is it ok for a request to be missing the protocol section?

[bull]

Yes. Nimda buffer overflow attempt.
See also [webmasterworld.com...]