[Snort-sigs] http_uri ... where does it end?

David Means w1t3h4t at ...2420...
Thu Sep 23 11:46:14 EDT 2010


I can't really address how snort parses the stream, but GET is the
method,  /resources/text.css is the URI/URL, and HTTP/1.1 is the
version.  The version is optional.  Headers begin after the trailing
CRLF, following either the URI or the version.  If following the URI,
the version must not be present.

---
David Means



On Thu, Sep 23, 2010 at 11:35 AM, Jason Wallace
<jason.r.wallace at ...2420...> wrote:
> For a web request like this...
>
> GET /resources/text.css HTTP/1.1
>
> GET is the http_method, but is HTTP/1.1 considered part of http_uri or
> http_header?
>
> thx,
> Wally
>
> ------------------------------------------------------------------------------
> Nokia and AT&T present the 2010 Calling All Innovators-North America contest
> Create new apps & games for the Nokia N8 for consumers in  U.S. and Canada
> $10 million total in prizes - $4M cash, 500 devices, nearly $6M in marketing
> Develop with Nokia Qt SDK, Web Runtime, or Java and Publish to Ovi Store
> http://p.sf.net/sfu/nokia-dev2dev
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-sigs
>




More information about the Snort-sigs mailing list