[Oisf-users] Error in parsing pcap: SEC_ERR_ALPARSER

[Geoff Whittington]

Hello,

I'm getting an error in the HTP module:

app-layer-htp.c:257: Error in parsing HTTP server response:
htp_response.c: Unable to match response to request.
app-layer-parser.ca:836 Error occured in parsing "http: app layer protocol...."

Wireshark displays the pcap correctly. However it is different from
the typical HTTP request/response session. The client is re-using the
connection to send another HTTP request, and the server responds
correctly. Is this the root of the problem ?

Due to copyright issues I will not be able to attach this pcap to the
email. This is a high-level description of the exchange:

-- snip --
GET / HTTP/1.1
....
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Length: YY

**Data**
GET / HTTP/1.1
...
Connection: Keep-Alive

HTTP/1.1 200
Content-Length: XX

**DATA**