Owssvr.dll and cltreq.asp


#1

I’m getting requests for _vti_bin/owssvr.dll and MSOffice/cltreq.asp, simultaneously, not always from the same pair of IPs, but always from two different IPs that Micrsft owns.

This happened ELEVEN times yesterday on one of my sites. Any idea what’s going on? Is this something I should be doing something about?


#2

Don’t have a clue, other than maybe somebody has a routing problem. I run Apache at home (DSL) and once I got a couple of requests for Yahoo!'s site! That was back when a major upstream provider had corrupted routing tables though. And this wouldn’t be the first time Microsoft has had DNS configuration problems either.

Their web site explains what owssvr.dll is used for at
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/spsdk11/Intro/overview.asp


#3

More likely it’s from machines infected with the nimda worm.

From a quick google:
http://www.webmasterworld.com/forum39/602.htm

Apache users (particularly those of us who run apache on DSL or cable modem lines) have been getting hit with Code Red and Nimda attempts for months.

They obviously have no effect on servers running Apache, but it is still annoying.


#4

A closer look at the logs can only tell. Apparently if a Windows users has Microsoft Office installed they can enable a “web discussions” feature in IE - which will then query the server to see if it supports discussions, and these requests should appear from a user who is also hitting a page on the site at the same time.

I imagine we’re going to have to get used to that kind of thing from Microsoft appearing in our logs if their clients are going to query any servers and not just IIS servers.