<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=gb2312">
<META content="MSHTML 6.00.2900.5945" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2> With --enable-debug, I found the packet been
ignored by STREAM_GAP, I think it's a bug. </FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>//ZhouLi</FONT></DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=zhou.li@ca-jc.com href="mailto:zhou.li@ca-jc.com">ZhouLi</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A
title=oisf-devel@openinfosecfoundation.org
href="mailto:oisf-devel@openinfosecfoundation.org">oisf-devel@openinfosecfoundation.org</A>
</DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Saturday, April 16, 2011 11:50
AM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> [Oisf-devel] no
APP_LAYER_PARSER_DONE for HTTP protocol?</DIV>
<DIV><FONT face=Arial size=2></FONT><FONT face=Arial size=2></FONT><BR></DIV>
<DIV><FONT face=Arial size=2>Hi, Victor</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2> I am writing some testing code for
suricata with clamav and I got a error log when GET a .exe file by wget or
curl, it </FONT></DIV>
<DIV><FONT face=Arial size=2>won't occour when using IE to GET a .exe file.
using tcpdump and found the log will be trigger when the first chunk packet
</FONT></DIV>
<DIV><FONT face=Arial size=2>arrive. bug?<BR> error log just like this,
<BR>(app-layer-parser.c:943) <Error> (AppLayerParse) -- [ERRCODE:
SC_ERR_ALPARSER(59)] - Error occured in parsing "http" app </FONT></DIV>
<DIV><FONT face=Arial size=2>layer protocol, using network protocol 6, source
IP address 192.168.88.108, destination IP address 192.168.88.1, src port
</FONT></DIV>
<DIV><FONT face=Arial size=2>36047 and dst port 80</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>//ZhouLi</FONT></DIV><BR>____ KILL Mail Shield
Gateway scanned ____<BR><BR>____ KILL Mail Shield Gateway scanned ____<BR>
<P>
<HR>
<P></P>_______________________________________________<BR>Oisf-devel mailing
list<BR>Oisf-devel@openinfosecfoundation.org<BR>http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel<BR><BR><BR>____
KILL Mail Shield Gateway scanned ____<BR><BR></BLOCKQUOTE>
<BR>
____ KILL Mail Shield Gateway scanned ____<BR>
</BODY></HTML>