[Snort-sigs] Snorting gzip encoded http source code

Jose Maria Lopez jkerouac at ...2755...
Tue Aug 31 13:38:36 EDT 2004


El mar, 31 de 08 de 2004 a las 01:43, Jason Haar escribió:
> On Mon, Aug 30, 2004 at 06:58:09PM +0000, Abe Use wrote:
> > I suppose I'll have my users connect through a proxy, and I'll have it 
> > strip or replace the "accept encoding gzip" portion of the header- so that 
> > I can match content plain-text. Would be cool though if snort was able to 
> > inflate the gzip'd stream, and look through the content... or save the 
> > stream and I could use something else to parse through it...
> 
> Yes - that feature makes NIDS increasingly useless for Web traffic. Similar
> problem to HTTPS - and I think your solution mis similar to how we handle
> HTTPS (put in a reverse proxy and sniff the unencrypted side). However
> it'll mean you don't get any of the performance benefits of compressed
> traffic - which is a pity...
> 

Maybe I'm wrong but you would get the performance benefits of having the
traffic compressed if what you want it's to save bandwidth in your
internet connection, because the 'gunzip' would be done in your local
network, where it shouldn't matter to have more traffic. So the proxy
option could be a good option.

> 
> A "uncompressor" preprocessor would be nice - but I have no idea what the
> performance impact would be...

It would be very nice.

-- 
Jose Maria Lopez Hernandez
Director Tecnico de bgSEC
jkerouac at ...2755...
bgSEC Seguridad y Consultoria de Sistemas Informaticos
http://www.bgsec.com
ESPAÑA

The only people for me are the mad ones -- the ones who are mad to live,
mad to talk, mad to be saved, desirous of everything at the same time,
the ones who never yawn or say a commonplace thing, but burn, burn, burn
like fabulous yellow Roman candles.
                -- Jack Kerouac, "On the Road"





More information about the Snort-sigs mailing list