<div dir="ltr"><div>That is great, glad I wasn't over looking something in the documentation. Thank you share sharing the code piece. </div><div><br></div><div>Is it possible to do something similar in the case where the protocol is not HTTP and just tcp? More specifically in a single stream over tcp. <br></div></div><br><div class="gmail_quote"><div dir="ltr">On Fri, Nov 9, 2018 at 1:09 PM Chris Wakelin <<a href="mailto:cwakelin@emergingthreats.net">cwakelin@emergingthreats.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I usually end up doing something like<br>
<br>
D = HttpGetResponseBody()<br>
d = ""<br>
for i = 1, #D, 1 do<br>
    d = d .. D[i]<br>
end<br>
<br>
then "#d" would be the response size. But there may be better ways<br>
depending; e.g. you might be able to trust a value from a response<br>
header, and of course you could just do<br>
<br>
d = 0<br>
for i = 1, #D, 1 do<br>
  d = d + #D[i]<br>
end<br>
<br>
if you just need the size.<br>
<br>
Best Wishes,<br>
Chris<br>
<br>
<br>
On 09/11/2018 13:07, Clark Kent wrote:<br>
> I tried looking at the available features in the documentation. So I<br>
> apologize if this is already answer there and I am just missing it.<br>
> <br>
> Is there a way to return the payload size when writing a LUA script?<br>
> <br>
> <br>
> _______________________________________________<br>
> Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank">oisf-users@openinfosecfoundation.org</a><br>
> Site: <a href="http://suricata-ids.org" rel="noreferrer" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" rel="noreferrer" target="_blank">http://suricata-ids.org/support/</a><br>
> List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" rel="noreferrer" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
> <br>
> Conference: <a href="https://suricon.net" rel="noreferrer" target="_blank">https://suricon.net</a><br>
> Trainings: <a href="https://suricata-ids.org/training/" rel="noreferrer" target="_blank">https://suricata-ids.org/training/</a><br>
> <br>
_______________________________________________<br>
Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank">oisf-users@openinfosecfoundation.org</a><br>
Site: <a href="http://suricata-ids.org" rel="noreferrer" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" rel="noreferrer" target="_blank">http://suricata-ids.org/support/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" rel="noreferrer" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
<br>
Conference: <a href="https://suricon.net" rel="noreferrer" target="_blank">https://suricon.net</a><br>
Trainings: <a href="https://suricata-ids.org/training/" rel="noreferrer" target="_blank">https://suricata-ids.org/training/</a></blockquote></div>