[Oisf-users] [ERRCODE: SC_ERR_ALPARSER(59)]

[Victor Julien]

Benjamin Burns wrote:
> I've been running some pcaps through suricata and I am getting alot of
> these Errors whilst its working through them. Does anybody have any clue
> why I might be getting these messages and what can I do to fix/prevent them?
> 
> 
> 30/9/2010 -- 16:01:59 - (app-layer-parser.c:931) <Error> (AppLayerParse)
> -- [ERRCODE: SC_ERR_ALPARSER(59)] - Error occured in parsing "http" app
> layer protocol, using network protocol 6, source IP address
> 10.103.2.166, destination IP address 193.60.151.200, src port 51142 and
> dst port 80

If the line above this one prints a libhtp error, then there is a reason
libhtp doesn't accept the traffic.

If there is no such line, it's probably due to packetloss causing the
stream reassembly engine to loose track. At this time the application
layer framework is unable to deal with such packetloss. In such a case
the stream will continue to be reassembled though, just only for normal
"content" and related keywords.

If you can (privately) provide a pcap showing the issue I can have a
look to see what is up.

Cheers,
Victor

-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------