1

I recently set up a test Nginx server on my computer, and I have been receiving some strange HTTP requests from another computer on the network:

192.168.1.114 - - [12/Jul/2015:17:12:42 +0000] "GET /currentsetting.htm HTTP/1.1" 404 168 "-" "-"
192.168.1.114 - - [12/Jul/2015:17:18:59 +0000] "GET /currentsetting.htm HTTP/1.1" 404 168 "-" "-"
192.168.1.114 - - [12/Jul/2015:17:25:12 +0000] "GET /currentsetting.htm HTTP/1.1" 404 168 "-" "-"
192.168.1.114 - - [12/Jul/2015:17:31:27 +0000] "GET /currentsetting.htm HTTP/1.1" 404 168 "-" "-"
192.168.1.114 - - [12/Jul/2015:17:37:40 +0000] "GET /currentsetting.htm HTTP/1.1" 404 168 "-" "-"
192.168.1.114 - - [12/Jul/2015:17:43:54 +0000] "GET /currentsetting.htm HTTP/1.1" 404 168 "-" "-"
192.168.1.114 - - [12/Jul/2015:17:50:09 +0000] "GET /currentsetting.htm HTTP/1.1" 404 168 "-" "-"
192.168.1.114 - - [12/Jul/2015:17:56:23 +0000] "GET /currentsetting.htm HTTP/1.1" 404 168 "-" "-"
192.168.1.114 - - [12/Jul/2015:18:02:36 +0000] "GET /currentsetting.htm HTTP/1.1" 404 168 "-" "-"

I see the same requests in the access log of another web server on the same network:

192.168.1.114 - - [12/Jul/2015:13:13:47 -0400] "GET /currentsetting.htm HTTP/1.1" 404 417 "-" "-"
192.168.1.114 - - [12/Jul/2015:13:20:04 -0400] "GET /currentsetting.htm HTTP/1.1" 404 417 "-" "-"
192.168.1.114 - - [12/Jul/2015:13:26:17 -0400] "GET /currentsetting.htm HTTP/1.1" 404 417 "-" "-"
192.168.1.114 - - [12/Jul/2015:13:32:32 -0400] "GET /currentsetting.htm HTTP/1.1" 404 417 "-" "-"
192.168.1.114 - - [12/Jul/2015:13:38:46 -0400] "GET /currentsetting.htm HTTP/1.1" 404 417 "-" "-"
192.168.1.114 - - [12/Jul/2015:13:44:59 -0400] "GET /currentsetting.htm HTTP/1.1" 404 417 "-" "-"
192.168.1.114 - - [12/Jul/2015:13:51:14 -0400] "GET /currentsetting.htm HTTP/1.1" 404 417 "-" "-"
192.168.1.114 - - [12/Jul/2015:13:57:28 -0400] "GET /currentsetting.htm HTTP/1.1" 404 417 "-" "-"

A Google search suggests that this is related to Netgear routers, and 192.168.1.114 is the only computer on the network running the Netgear Genie application. Indeed, the currentsetting.htm file on the router has some information that may be used by the application:

maxwell:~ andrew$ curl 192.168.1.1/currentsetting.htm
Firmware=V1.0.0.2_1.0.1
RegionTag=R6700_NA
Region=us
Model=R6700
InternetConnectionStatus=Up
ParentalControlSupported=1
SOAPVersion=2.0
ReadyShareSupportedLevel=13
SmartNetworkSupported=0

Why does the Netgear Genie application seem to be sending HTTP requests to every web server on port 80 on the network?
How would I stop this strange behavior from happening?

1
  • I'm guessing that rather than relying on the default gateway, the Genie looks for any computer with an open port 80 to attempt to poll the router for information. It's not strange as such - I can think of better ways of doing it though.
    – James Hyde
    May 10, 2016 at 11:47

1 Answer 1

3

Just create a webpage on your web servers called "currentsetting.htm", containing one line, for example:

Model=raspberrypi

Just text, no HTML markup, despite it being a .htm file.

Then Genie will send the GET request just once, as it will actually now receive a reply.

As a bonus, whatever value you give for Model will appear as the node name in Genie's network map.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.