[Oisf-devel] enhancement requests for app-layer-detect-proto on suricata

Victor Julien victor at inliniac.net
Mon May 3 12:38:39 UTC 2010

rmkml wrote:
> Hi,
> First, Im request enhancement for app-layer-detect-proto, by adding space or tab after http method. For low cost (doubling existing http content) but maybe reducing FP, like this:
>   "GET|20|"
>   "GET|09|"
>   ...
> Second, why you don't have "/" after http server response/reply like this:
>   "HTTP/"
> for reducing, of course, possible FP.
> Third, It is possible adding HEAD http method please ?

Thanks Rmkml, the new git master has all changes you requested.


Victor Julien
PGP: http://www.inliniac.net/victorjulien.asc

More information about the Oisf-devel mailing list