[Snort-sigs] http_uri ... where does it end?

David Means w1t3h4t at ...2420...
Thu Sep 23 11:46:14 EDT 2010

I can't really address how snort parses the stream, but GET is the
method,  /resources/text.css is the URI/URL, and HTTP/1.1 is the
version.  The version is optional.  Headers begin after the trailing
CRLF, following either the URI or the version.  If following the URI,
the version must not be present.

David Means

On Thu, Sep 23, 2010 at 11:35 AM, Jason Wallace
<jason.r.wallace at ...2420...> wrote:
> For a web request like this...
> GET /resources/text.css HTTP/1.1
> GET is the http_method, but is HTTP/1.1 considered part of http_uri or
> http_header?
> thx,
> Wally
> ------------------------------------------------------------------------------
> Nokia and AT&T present the 2010 Calling All Innovators-North America contest
> Create new apps & games for the Nokia N8 for consumers in  U.S. and Canada
> $10 million total in prizes - $4M cash, 500 devices, nearly $6M in marketing
> Develop with Nokia Qt SDK, Web Runtime, or Java and Publish to Ovi Store
> http://p.sf.net/sfu/nokia-dev2dev
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-sigs

More information about the Snort-sigs mailing list