最近我们将系统从。net 1.1升级到。net 2.0。由于这样做，我们的事件日志中每分钟都会出现以下错误。很奇怪，所有的客户端ip或用户主机地址似乎都指向东欧国家，比如俄罗斯或白俄罗斯。这是一个日志问题还是有人合法地试图入侵或其他什么?-
Information 8/2/2011 15:02 ASP.NET 2.0.50727.0 1316 Web Event Event code: 4009
Event message: Viewstate verification failed. Reason: Viewstate was invalid.
Event time: 8/2/2011 3:02:36 PM
Event time (UTC): 8/2/2011 7:02:36 PM
Event ID: e25e0918f9e34bda98abcafadc61a0b6
Event sequence: 144401
Event occurrence: 5595
Event detail code: 50204
Application information:
Application domain: OMMITED-OMMITED
Trust level: Full
Application Virtual Path: /DirID
Application Path: W:SITEDirID
Machine name: OMMITED-OMMITED
Process information:
Process ID: 1740
Process name: w3wp.exe
Account name: NT AUTHORITYSYSTEM
Request information:
Request URL: http://www.mysite.com/DirID/Default.aspx
Request path: /DirID/Default.aspx
User host address: 176.14.136.181
User:
Is authenticated: False
Authentication Type:
Thread account name: NT AUTHORITYSYSTEM
ViewStateException information:
Exception message: Invalid viewstate.
Client IP: 176.14.136.181
Port: 63815
User-Agent: TrackChecker
PersistedState: [KEY1]
Referer: http://www.mysite.com/DirID/Default.aspx
Path: /DirID/Default.aspx
-------------------------
Information 8/2/2011 14:57 ASP.NET 2.0.50727.0 1316 Web Event Event code: 4009
Event message: Viewstate verification failed. Reason: Viewstate was invalid.
Event time: 8/2/2011 2:57:11 PM
Event time (UTC): 8/2/2011 6:57:11 PM
Event ID: 4d814be560f64258b2c926814fdb10c6
Event sequence: 142726
Event occurrence: 5536
Event detail code: 50204
Application information:
Application domain: OMMITED-OMMITED
Trust level: Full
Application Virtual Path: /DirID
Application Path: W:SITEDirID
Machine name: OMMITED-OMMITED
Process information:
Process ID: 1740
Process name: w3wp.exe
Account name: NT AUTHORITYSYSTEM
Request information:
Request URL: http://www.mysite.com/DirID/Default.aspx
Request path: /DirID/Default.aspx
User host address: 213.87.131.86
User:
Is authenticated: False
Authentication Type:
Thread account name: NT AUTHORITYSYSTEM
ViewStateException information:
Exception message: Invalid viewstate.
Client IP: 213.87.131.86
Port: 21441
User-Agent:
PersistedState: [KEY1]
Referer: http://www.mysite.com/DirID/Default.aspx
Path: /DirID/Default.aspx
-----------
Information 8/2/2011 14:56 ASP.NET 2.0.50727.0 1316 Web Event Event code: 4009
Event message: Viewstate verification failed. Reason: The viewstate supplied failed integrity check.
Event time: 8/2/2011 2:56:10 PM
Event time (UTC): 8/2/2011 6:56:10 PM
Event ID: e20e446446374000bf9ad9c6863192e8
Event sequence: 142476
Event occurrence: 5534
Event detail code: 50203
Application information:
Application domain: OMMITED-OMMITED
Trust level: Full
Application Virtual Path: /DirID
Application Path: W:SITEDirID
Machine name: OMMITED-OMMITED
Process information:
Process ID: 1740
Process name: w3wp.exe
Account name: NT AUTHORITYSYSTEM
Request information:
Request URL: http://www.mysite.com/DirID/Default.aspx
Request path: /DirID/Default.aspx
User host address: 85.174.246.134
User:
Is authenticated: False
Authentication Type:
Thread account name: NT AUTHORITYSYSTEM
ViewStateException information:
Exception message: Invalid viewstate.
Client IP: 85.174.246.134
Port: 3957
User-Agent: TrackChecker
PersistedState: dDwxNTA2NDg4MjAzO3Q8O2w8aTwzPjs+O2w8dDw7bDxpPDE+O2k8OT47aTwxMT47aTwxMz47aTwxNT47aTwxNz47aTwxOT47aTwyMT47aTwyMz47aTwyND47aTwyNT47aTwyNj47aTwzMj47aTwzND47PjtsPHQ8O2w8aTwzPjtpPDE5PjtpPDQxPjs+O2w8dDxwPHA8bDxWaXNpYmxlOz47bDxvPGY+Oz4+Oz47Oz47dDxwPHA8bDxOYXZpZ2F0ZVVybDtGb250X0JvbGQ7XyFTQjs+O2w8XGU7bzx0PjtpPDIwNDg+Oz4+Oz47Oz47dDxwPHA8bDxWaXNpYmxlOz47bDxvPGY+Oz4+Oz47Oz47Pj47dDxwPHA8bDxWaXNpYmxlOz47bDxvPGY+Oz4+Oz47Oz47dDxwPHA8bDxWaXNpYmxlOz47bDxvPGY+Oz4+Oz47Oz47dDxwPDtwPGw8b25rZXlwcmVzczs+O2w8cmV0dXJuIEtleVByZXNzSGFuZGxlcihldmVudCk7Pj4+Ozs+O3Q8cDw7cDxsPG9ua2V5cHJlc3M7PjtsPHJldHVybiBLZXlQcmVzc0hhbmRsZXIoZXZlbnQpOz4+Pjs7Pjt0PHA8O3A8bDxvbmtleXByZXNzOz47bDxyZXR1cm4gS2V5UHJlc3NIYW5kbGVyKGV2ZW50KTs+Pj47Oz47dDxwPDtwPGw8b25rZXlwcmVzczs+O2w8cmV0dXJuIEtleVByZXNzSGFuZGxlcihldmVudCk7Pj4+Ozs+O3Q8cDw7cDxsPG9ua2V5cHJlc3M7PjtsPHJldHVybiBLZXlQcmVzc0hhbmRsZXIoZXZlbnQpOz4+Pjs7Pjt0PDtsPGk8MT47aTwzPjtpPDU+O2k8Nz47aTw5Pjs+O2w8dDxwPDtwPGw8b25rZXlwcmVzczs+O2w8cmV0dXJuIEtleVByZXNzSGFuZGxlcihldmVudCk7Pj4+Ozs+O3Q8cDw7cDxsPG9ua2V5cHJlc3M7PjtsPHJldHVybiBLZXlQcmVzc0hhbmRsZXIoZXZlbnQpOz4+Pjs7Pjt0PHA8O3A8bDxvbmtleXByZXNzOz47bDxyZXR1cm4gS2V5UHJlc3NIYW5kbGVyKGV2ZW50KTs+Pj47Oz47dDxwPDtwPGw8b25rZXlwcmVzczs+O2w8cmV0dXJuIEtleVByZXNzSGFuZGxlcihldmVudCk7Pj4+Ozs+O3Q8cDw7cDxsPG9ua2V5cHJlc3M7PjtsPHJldHVybiBLZXlQcmVzc0hhbmRsZXIoZXZlbnQpOz4+Pjs7Pjs+Pjt0PDtsPGk8MT47aTwzPjtpPDU+O2k8Nz47aTw5Pjs+O2w8dDxwPDtwPGw8b25rZXlwcmVzczs+O2w8cmV0dXJuIEtleVByZXNzSGFuZGxlcihldmVudCk7Pj4+Ozs+O3Q8cDw7cDxsPG9ua2V5cHJlc3M7PjtsPHJldHVybiBLZXlQcmVzc0hhbmRsZXIoZXZlbnQpOz4+Pjs7Pjt0PHA8O3A8bDxvbmtleXByZXNzOz47bDxyZXR1cm4gS2V5UHJlc3NIYW5kbGVyKGV2ZW50KTs+Pj47Oz47dDxwPDtwPGw8b25rZXlwcmVzczs+O2w8cmV0dXJuIEtleVByZXNzSGFuZGxlcihldmVudCk7Pj4+Ozs+O3Q8cDw7cDxsPG9ua2V5cHJlc3M7PjtsPHJldHVybiBLZXlQcmVzc0hhbmRsZXIoZXZlbnQpOz4+Pjs7Pjs+Pjt0PDtsPGk8MT47aTwzPjtpPDU+O2k8Nz47aTw5Pjs+O2w8dDxwPDtwPGw8b25rZXlwcmVzczs+O2w8cmV0dXJuIEtleVByZXNzSGFuZGxlcihldmVudCk7Pj4+Ozs+O3Q8cDw7cDxsPG9ua2V5cHJlc3M7PjtsPHJldHVybiBLZXlQcmVzc0hhbmRsZXIoZXZlbnQpOz4+Pjs7Pjt0PHA8O3A8bDxvbmtleXByZXNzOz47bDxyZXR1cm4gS2V5UHJlc3NIYW5kbGVyKGV2ZW50KTs+Pj47Oz47dDxwPDtwPGw8b25rZXlwcmVzczs+O2w8cmV0dXJuIEtleVByZXNzSGFuZGxlcihldmVudCk7Pj4+Ozs+O3Q8cDw7cDxsPG9ua2V5cHJlc3M7PjtsPHJldHVybiBLZXlQcmVzc0hhbmRsZXIoZXZlbnQpOz4+Pjs7Pjs+Pjt0PDtsPGk8MT47aTwzPjtpPDU+O2k8Nz47aTw5Pjs+O2w8dDxwPDtwPGw8b25rZXlwcmVzczs+O2w8cmV0dXJuIEtleVByZXNzSGFuZGxlcihldmVudCk7Pj4+Ozs+O3Q8cDw7cDxsPG9ua2V5cHJlc3M7PjtsPHJldHVybiBLZXlQcmVzc0hhbmRsZXIoZXZlbnQpOz4+Pjs7Pjt0PHA8O3A8bDxvbmtleXByZXNzOz47bDxyZXR1cm4gS2V5UHJlc3NIYW5kbGVyKGV2ZW50KTs+Pj47Oz47dDxwPDtwPGw8b25rZXlwcmVzczs+O2w8cmV0dXJuIEtleVByZXNzSGFuZGxlcihldmVudCk7Pj4+Ozs+O3Q8cDw7cDxsPG9ua2V5cHJlc3M7PjtsPHJldHVybiBLZXlQcmVzc0hhbmRsZXIoZXZlbnQpOz4+Pjs7Pjs+Pjt0PHA8O3A8bDxvbmNsaWNrOz47bDxTaG93SGlkZVNlY3Rpb24oJ1VQU01JX1Byb2Nlc3NfTG9uZycpXDs7Pj4+Ozs+O3Q8cDw7cDxsPG9uY2xpY2s7PjtsPFNob3dIaWRlU2VjdGlvbignVVBTTUlfUHJvY2Vzc19Mb25nJylcOzs+Pj47Oz47Pj47Pj47bDxidG5UcmFjazs+PgqCqg5dK4H3lAraES3/cf/YlkUD
Referer: http://www.mysite.com/DirID/Default.aspx
Path: /DirID/Default.aspx
前2个请求导致了视图状态验证/验证问题，因为这个:PersistedState: [KEY1] -这是一个直接的验证错误。
还有——你说你已经从。net 1.1升级到2.0了但是第三个请求中提供的视图状态以"dDw"开头——这是。net 1.1的视图状态(对于。net 2.0，它以"/wE"开头)
在用户代理中看到"TrackChecker"告诉我，某种bot/crawler保存了旧版本的页面(当它们是由。net 1.1生成的-包括视图状态)，现在它正在重新检查你的内容并提交无效的视图状态(。.Net 1.1视图状态在。Net 2.0上验证失败，原因很明显)
我在我的一个网站上得到了很多这样的Viewstate错误，这通常是一个机器人试图运气发布一些邪恶的东西。
我怀疑这里也是一样的-除非你有很多来自白俄罗斯的用户?
如果您修改日志以捕获查询字符串和其他请求参数，则可以为您提供一些线索，以了解(所谓的)攻击者-或不幸的用户-试图达到的目的。