I think we should test how these researched cases are handled by suricata and libhtp: http://noxxi.de/research/dubious-http.html -- --------------------------------------------- Victor Julien http://www.inliniac.net/ PGP: http://www.inliniac.net/victorjulien.asc ---------------------------------------------