[Oisf-users] Error in parsing pcap: SEC_ERR_ALPARSER

Geoff Whittington geoff.whittington at gmail.com
Thu Mar 18 18:56:13 UTC 2010


I'm getting an error in the HTP module:

app-layer-htp.c:257: Error in parsing HTTP server response:
htp_response.c: Unable to match response to request.
app-layer-parser.ca:836 Error occured in parsing "http: app layer protocol...."

Wireshark displays the pcap correctly. However it is different from
the typical HTTP request/response session. The client is re-using the
connection to send another HTTP request, and the server responds
correctly. Is this the root of the problem ?

Due to copyright issues I will not be able to attach this pcap to the
email. This is a high-level description of the exchange:

-- snip --
GET / HTTP/1.1
Connection: Keep-Alive

HTTP/1.1 200 OK
Content-Length: YY

GET / HTTP/1.1
Connection: Keep-Alive

HTTP/1.1 200
Content-Length: XX


More information about the Oisf-users mailing list