# \[8.1.44\] Flood of org.eclipse.jetty.http.BadMessageException: 400: No Host **URL:** \ **Category:** Ignition\ **Tags:** ignition81\ **Created:** [March 24, 2025, 4:43pm UTC](https://forum.inductiveautomation.com/t/8-1-44-flood-of-org-eclipse-jetty-http-badmessageexception-400-no-host/104107 "2025-03-24T16:43:28Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![ryan.white](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ryan.white/32/73193_2.png) [@ryan.white](https://forum.inductiveautomation.com/u/ryan.white)\ **Post date:** [March 24, 2025, 4:43pm UTC](https://forum.inductiveautomation.com/t/8-1-44-flood-of-org-eclipse-jetty-http-badmessageexception-400-no-host/104107/1 "2025-03-24T16:43:28Z")
Following a server update (not an Ignition update) over the weekend our logs have been sporadically filled with large groups of `some/file/path org.eclipse.jetty.http.BadMessageException: 400: No Host` The specific logger is `org.eclipse.jetty.server.HttpChannel` Some quick `wrapper.log` snippets: ```python INFO | jvm 1 | 2025/03/24 11:13:36 | W [o.e.j.s.HttpChannel] [11:13:36.373]: handleException /PCI2/recipe_release/wwwroot/assets/php/_core/calendar.php org.eclipse.jetty.http.BadMessageException: 400: No Host INFO | jvm 1 | 2025/03/24 11:13:36 | W [o.e.j.s.HttpChannel] [11:13:36.416]: handleException /PCI2/recipe_release/wwwroot/recipe/recipe_search.php org.eclipse.jetty.http.BadMessageException: 400: No Host INFO | jvm 1 | 2025/03/24 11:13:36 | W [o.e.j.s.HttpChannel] [11:13:36.454]: handleException /PCI2/recipe_release/wwwroot/recipe/recipe_view.php org.eclipse.jetty.http.BadMessageException: 400: No Host INFO | jvm 1 | 2025/03/24 11:13:36 | W [o.e.j.s.HttpChannel] [11:13:36.495]: handleException /PCI2/recipe_release/wwwroot/recipe/login.php org.eclipse.jetty.http.BadMessageException: 400: No Host INFO | jvm 1 | 2025/03/24 11:14:46 | W [o.e.j.s.HttpChannel] [11:14:46.778]: handleException /assets/php/_core/calendar.php org.eclipse.jetty.http.BadMessageException: 400: No Host INFO | jvm 1 | 2025/03/24 11:14:46 | W [o.e.j.s.HttpChannel] [11:14:46.818]: handleException /recipe/assets/php/_core/calendar.php org.eclipse.jetty.http.BadMessageException: 400: No Host INFO | jvm 1 | 2025/03/24 11:14:46 | W [o.e.j.s.HttpChannel] [11:14:46.860]: handleException /recipe/recipe_view.php org.eclipse.jetty.http.BadMessageException: 400: No Host INFO | jvm 1 | 2025/03/24 11:14:46 | W [o.e.j.s.HttpChannel] [11:14:46.902]: handleException /recipe/recipe/recipe_view.php org.eclipse.jetty.http.BadMessageException: 400: No Host INFO | jvm 1 | 2025/03/24 11:14:47 | W [o.e.j.s.HttpChannel] [11:14:46.946]: handleException /recipe/login.php org.eclipse.jetty.http.BadMessageException: 400: No Host INFO | jvm 1 | 2025/03/24 11:14:47 | W [o.e.j.s.HttpChannel] [11:14:46.987]: handleException /recipe/recipe/login.php org.eclipse.jetty.http.BadMessageException: 400: No Host INFO | jvm 1 | 2025/03/24 11:14:47 | W [o.e.j.s.HttpChannel] [11:14:47.026]: handleException /recipe/recipe_search.php org.eclipse.jetty.http.BadMessageException: 400: No Host INFO | jvm 1 | 2025/03/24 11:14:47 | W [o.e.j.s.HttpChannel] [11:14:47.066]: handleException /recipe/recipe/recipe_search.php org.eclipse.jetty.http.BadMessageException: 400: No Host INFO | jvm 1 | 2025/03/24 12:04:41 | W [o.e.j.s.HttpChannel] [12:04:41.313]: handleException /index.php org.eclipse.jetty.http.BadMessageException: 400: No Host INFO | jvm 1 | 2025/03/24 12:04:41 | W [o.e.j.s.HttpChannel] [12:04:41.352]: handleException /html/index.php org.eclipse.jetty.http.BadMessageException: 400: No Host INFO | jvm 1 | 2025/03/24 12:04:41 | W [o.e.j.s.HttpChannel] [12:04:41.393]: handleException /mambo/index.php org.eclipse.jetty.http.BadMessageException: 400: No Host INFO | jvm 1 | 2025/03/24 12:04:41 | W [o.e.j.s.HttpChannel] [12:04:41.438]: handleException /Mambo/index.php org.eclipse.jetty.http.BadMessageException: 400: No Host INFO | jvm 1 | 2025/03/24 12:04:42 | W [o.e.j.s.HttpChannel] [12:04:42.777]: handleException / org.eclipse.jetty.http.BadMessageException: 400: No Host INFO | jvm 1 | 2025/03/24 12:04:42 | W [o.e.j.s.HttpChannel] [12:04:42.816]: handleException /bugzilla/ org.eclipse.jetty.http.BadMessageException: 400: No Host ``` I'm highly suspicious that this is the result of some security service interfering with Ignition but wanted to confirm it wasn't something failing on its own in Ignition. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [March 24, 2025, 4:47pm UTC](https://forum.inductiveautomation.com/t/8-1-44-flood-of-org-eclipse-jetty-http-badmessageexception-400-no-host/104107/2 "2025-03-24T16:47:33Z")
Something on your network is doing a scan, finding Ignition, and making some bogus HTTP requests. ---
**Author:** ![ryan.white](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ryan.white/32/73193_2.png) [@ryan.white](https://forum.inductiveautomation.com/u/ryan.white)\ **Post date:** [March 24, 2025, 4:51pm UTC](https://forum.inductiveautomation.com/t/8-1-44-flood-of-org-eclipse-jetty-http-badmessageexception-400-no-host/104107/3 "2025-03-24T16:51:12Z")
~~Guess they haven't found the dev server yet, prod server is the one only doing this right now.~~ Edit: nope, cursed that into existence. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [March 24, 2025, 4:53pm UTC](https://forum.inductiveautomation.com/t/8-1-44-flood-of-org-eclipse-jetty-http-badmessageexception-400-no-host/104107/4 "2025-03-24T16:53:10Z")
> [@ryan.white](#): > > nope, cursed Mwah, hah, hah! Indeed! 🤣 ---
**Author:** ![ryan.white](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ryan.white/32/73193_2.png) [@ryan.white](https://forum.inductiveautomation.com/u/ryan.white)\ **Post date:** [March 25, 2025, 3:25pm UTC](https://forum.inductiveautomation.com/t/8-1-44-flood-of-org-eclipse-jetty-http-badmessageexception-400-no-host/104107/5 "2025-03-25T15:25:29Z")
Submitted a ticket to my IT department to track this down and they are wondering if there is any way for Ignition to report back where the source of these scans is coming from. Is there a logger I can set to a different level to get it to spit out the IP that made the request? ---
**Author:** ![Lina\_Su](https://avatars.discourse-cdn.com/v4/letter/l/7ba0ec/32.png) [@Lina\_Su](https://forum.inductiveautomation.com/u/Lina_Su)\ **Post date:** [March 26, 2025, 1:21pm UTC](https://forum.inductiveautomation.com/t/8-1-44-flood-of-org-eclipse-jetty-http-badmessageexception-400-no-host/104107/6 "2025-03-26T13:21:09Z")
I am facing same issue, any idea how this happen . ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/9/0/90313737cb763df8d115eaecefb094a1324c3692.png) ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [March 26, 2025, 1:31pm UTC](https://forum.inductiveautomation.com/t/8-1-44-flood-of-org-eclipse-jetty-http-badmessageexception-400-no-host/104107/7 "2025-03-26T13:31:44Z")
> [@ryan.white](#): > > Is there a logger I can set to a different level to get it to spit out the IP that made the request? It'll be a mess, but if you set all of the `org.eclipse.jetty` loggers to DEBUG level some of the log messages will have the remote host/IP in them. ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/9/b/9bd3216f4784f427804e93f8a2eb192b27caba6f.png) e.g. ```python HttpConnection 26Mar2025 06:32:42 HttpConnection@3394d470::SocketChannelEndPoint@7ff2fe0e[{l=/127.0.0.1:8088,r=/127.0.0.1:57412,ISHUT,fill=-,flush=-,to=0/30000}{io=0/0,kio=0,kro=1}]->[HttpConnection@3394d470[p=HttpParser{s=START,0 of -1},g=HttpGenerator@3e58426{s=START}]=>HttpChannelOverHttp@72155ac9{s=HttpChannelState@4fea5341{s=IDLE rs=BLOCKING os=OPEN is=IDLE awp=false se=false i=true al=0},r=1,c=false/false,a=IDLE,uri=null,age=0}] filled -1 RetainableByteBuffer@249c1293{DirectByteBuffer@27daddac[p=0,l=0,c=8192,r=0]={<<<>>>GET /Stat...\x00\x00\x00\x00\x00\x00\x00},r=1} ``` which has: ```python l=/127.0.0.1:8088,r=/127.0.0.1:57412 ``` ---
**Author:** ![michael.flagler](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/michael.flagler/32/26272_2.png) [@michael.flagler](https://forum.inductiveautomation.com/u/michael.flagler)\ **Post date:** [March 26, 2025, 1:50pm UTC](https://forum.inductiveautomation.com/t/8-1-44-flood-of-org-eclipse-jetty-http-badmessageexception-400-no-host/104107/8 "2025-03-26T13:50:43Z")
This is why on Linux, I like throwing an HAProxy reverse proxy in front of Ignition especially if Internet facing. This information will all show up in logs and if necessary, can implement fail2ban to even ban the source IP. I kinda wish Ignition's wrapper log would show failed logins so that I can use fail2ban to also ban IPs that have an extra amount of failed logins. (Yes, I know Ignition can also block failed logins, but I much prefer the "block the source IP" route) ---
**Author:** ![ryan.white](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ryan.white/32/73193_2.png) [@ryan.white](https://forum.inductiveautomation.com/u/ryan.white)\ **Post date:** [March 26, 2025, 3:54pm UTC](https://forum.inductiveautomation.com/t/8-1-44-flood-of-org-eclipse-jetty-http-badmessageexception-400-no-host/104107/9 "2025-03-26T15:54:37Z")
> [@Kevin.Herron](#): > > loggers to DEBUG Thankfully whatever was spamming appears to have stopped for now. I'll hold this in my back pocket to turn on if the problem reappears. > [@michael.flagler](#): > > on Linux I'm unfortunately stuck (see _cursed_) with a winblows environment. Our Ignition/manufacturing servers run in an isolated vlan so that narrows the source down to something™ in our corporate network., which is still a lot of stuff. ---
**Author:** ![ryan.white](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ryan.white/32/73193_2.png) [@ryan.white](https://forum.inductiveautomation.com/u/ryan.white)\ **Post date:** [March 26, 2025, 4:23pm UTC](https://forum.inductiveautomation.com/t/8-1-44-flood-of-org-eclipse-jetty-http-badmessageexception-400-no-host/104107/10 "2025-03-26T16:23:38Z")
Doing a little more digging, the `/QUALYS730###` appears to be related to a vulnerability scan used to detect a known Apache Tomcat vulnerability. Vulnerability scanning will apparently do a `GET /QUALYS####### HTTP/1.0` to get the Tomcat version back in the header. > **[Apache Tomcat HTTP Request Smuggling Vulnerability (CVE-2021-33037) | Qualys...](https://blog.qualys.com/vulnerabilities-threat-research/2021/10/27/apache-tomcat-http-request-smuggling-vulnerability-cve-2021-33037)** > > A vulnerability (CVE-2021-33037) discovered this year in Apache Tomcat causes incorrect parsing of the HTTP transfer-encoding request header in some circumstances, leading to the possibility of HTTP… > **[PowerProtect DP Series Appliances and IDPA: Security Vulnerability scanning...](https://www.dell.com/support/kbdoc/en-us/000205073/powerprotect-dp-series-appliances-and-idpa-security-vulnerability-scanning-detected-an-apache-tomcat-vulnerability-for-version-9-0-45)** See reply #2 in this cisco thread: > **[CSPC Security Vulnerability CVE-2016-1908](https://community.cisco.com/t5/smart-net-total-care-portal-and-collector-discussions/cspc-security-vulnerability-cve-2016-1908/td-p/4990764)** > > Number for SSH vulnerability: CSPC Security Vulnerability  Description: OpenSSH Improper Failed Cookie Generation Handling Vulnerability Please advise a method on finding the existing OpenSSH version of the CSPC from GUI.