I've got a PHP server running on Apache, I recieve plenty of request appears like this,

10.1.1.211 - - [02/Sep/2010:16:14:31 -0400] "GET /request?_=1283458471913&action=get_list HTTP/1.1" 200 547  "http://world wide web.example.com/request" "Mozilla/5. (Home windows U Home windows NT 5.1 en-US rv:1.9.2.8) Gecko/20100722 Opera/3.6.8 (.Internet CLR 3.5.30729)" 28632 15602

The _ parameter is inexplicably put into the request. I'm attempting to discover who's doing that.

There's a NetScaler running before Apache.

jQuery adds a parameter like this to obtain around IE's caching.

edit: it only adds it for get demands, and only when the choice cache is false:

cache: false

Most likely it is a dummy parameter added through the reverse proxy to pressure non-cached content to become offered.

1283458471913 is really a unix timestamp in ms, most likely a bot/proxy ensuring they obtain a fresh page and never a cached version.

May be jQuery which may cause this for AJAX request of you will find the nocache attribute set to true.

if ( s.cache === false &lifier&lifier type == "GET" ) changing _= if it's there

    var ret = s.url.replace(/(?&lifier)_=.*?(&lifier$)/, "$1_=" + ts + "$2″)

    // if nothing was changed, add timestamp towards the finish

    s.url = ret + ((ret == s.url) ? (s.url.match(/?/) ? "&lifier" : "?") + "_=" + ts : "")