[Oisf-devel] suricata app-layer-htp response Zero-length data chunks maybe a error?

rmkml rmkml at free.fr
Wed Apr 28 09:51:05 UTC 2010

I have downloaded last suricata git version (v0.8.2 release have same pb), and I have this error with joigned pcap file:
  [25537] 28/4/2010 -- 13:14:28 - (app-layer-htp.c:406) <Error> (HTPHandleResponseData) -- [ERRCODE: SC_ERR_ALPARSER(56)] - Error in parsing HTTP server response: [1] [htp_response.c] [733] Zero-length data chunks are not allowed
  [25537] 28/4/2010 -- 13:14:28 - (app-layer-parser.c:831) <Error> (AppLayerParse) -- [ERRCODE: SC_ERR_ALPARSER(56)] - Error occured in parsing "http" app layer protocol, using network protocol 6, source IP address, destination IP address, src port 51173 and dst port 80
If anyone have a idea please?
Joigned pcap file (not fuzing, it's a real/live trafic) contains https connection to ocsp_verisign since firefox browser.
If you confirm pb, I create a new ticket on redmine.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: exemple_http_ocspverisign_suricataapplayerhttpzerolengthdatachunks28apr2010.pcap
Type: application/cap
Size: 3590 bytes
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-devel/attachments/20100428/8b59d9b4/attachment.bin>

More information about the Oisf-devel mailing list