[Oisf-devel] suricata app-layer-htp response Zero-length data chunks maybe a error?

rmkml rmkml at free.fr
Wed Apr 28 09:51:05 UTC 2010


Hi,
I have downloaded last suricata git version (v0.8.2 release have same pb), and I have this error with joigned pcap file:
  [25537] 28/4/2010 -- 13:14:28 - (app-layer-htp.c:406) <Error> (HTPHandleResponseData) -- [ERRCODE: SC_ERR_ALPARSER(56)] - Error in parsing HTTP server response: [1] [htp_response.c] [733] Zero-length data chunks are not allowed
  [25537] 28/4/2010 -- 13:14:28 - (app-layer-parser.c:831) <Error> (AppLayerParse) -- [ERRCODE: SC_ERR_ALPARSER(56)] - Error occured in parsing "http" app layer protocol, using network protocol 6, source IP address 10.50.1.208, destination IP address 199.7.71.72, src port 51173 and dst port 80
If anyone have a idea please?
Joigned pcap file (not fuzing, it's a real/live trafic) contains https connection to ocsp_verisign since firefox browser.
If you confirm pb, I create a new ticket on redmine.
Regards
Rmkml
-------------- next part --------------
A non-text attachment was scrubbed...
Name: exemple_http_ocspverisign_suricataapplayerhttpzerolengthdatachunks28apr2010.pcap
Type: application/cap
Size: 3590 bytes
Desc: 
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-devel/attachments/20100428/8b59d9b4/attachment.bin>


More information about the Oisf-devel mailing list