[Oisf-users] Suricata support for size of HTTP bodies

Andreas Herz andi at geekosphere.org
Mon May 2 22:03:27 UTC 2016

On 22/04/16 at 16:08, Darren S. wrote:
> Is it possible to introduce keywords that can function similar to
> 'dsize', but provides the size of the HTTP request body and the HTTP
> response body?
> If I'm not mistaken dsize cannot be used alongside "app layer"
> keywords and it would be great to have keywords providing size of
> buffers not including headers, etc.
> I think this may be same/similar to this issue:
> # Feature #735: "Introduce content_len keyword"
> https://redmine.openinfosecfoundation.org/issues/735
> To take this a step further, does it make sense to introduce keywords
> for the size of each buffer provided at the HTTP layer, period?

I would suggest that you open a new issue for that (Feature Request) so
we can discuss that :)

Andreas Herz

More information about the Oisf-users mailing list