[Oisf-users] Suricata support for size of HTTP bodies

[Andreas Herz]

On 22/04/16 at 16:08, Darren S. wrote:
> Is it possible to introduce keywords that can function similar to
> 'dsize', but provides the size of the HTTP request body and the HTTP
> response body?
> 
> If I'm not mistaken dsize cannot be used alongside "app layer"
> keywords and it would be great to have keywords providing size of
> buffers not including headers, etc.
> 
> I think this may be same/similar to this issue:
> 
> # Feature #735: "Introduce content_len keyword"
> https://redmine.openinfosecfoundation.org/issues/735
> 
> 
> To take this a step further, does it make sense to introduce keywords
> for the size of each buffer provided at the HTTP layer, period?

I would suggest that you open a new issue for that (Feature Request) so
we can discuss that :)

-- 
Andreas Herz