Re: sniffing SSL (was OT: mod_ssl (apache) log entries -- wtf?)

["Keith G. Murphy" <keithmur@mindspring.com>]

Will Trillich wrote:
 >
 > but the odd part is, they didn't just come in from the top
 > (first uri was not "/"). it reflects either a) the result of a
 > prior drill-down or 2) an exact echo of my previous request, but
 > somehow coming from outside in the internet.
 >
You may have already done this, but the first thing I would check is
whether some interface somewhere on your LAN is misconfigured and set up
as that "MIT" IP address.  It seems unlikely that it's really coming
from outside.

As far as it being an "echo": sometimes strange things can happen due to
   apache misconfiguration; like when the page references an image, but
due to proxying, redirection, mod-perl handling, etc., apache wants to
reload the page instead.  Check out those style sheet references from
the root, for example.

Hmmm, makes me think the Apache machine itself may have that address
configured somewhere...