[Bro] HTTP Content Disposition

Seth Hall seth at icir.org
Fri Oct 16 06:42:43 PDT 2015

> On Oct 16, 2015, at 9:22 AM, Albert Zaharovits <albert.zaharovits at gmail.com> wrote:
> I thought it might be a bug too…
> I already started browsing the source/debugging, but no success so far…
> Any leads? Where should I focus my attention?
> I would like to submit a pull request!

I would focus on the interplay where the c$http$current_entity field is set.  I’m not exactly sure which script it will be in, but you should be able to find all of the places where that’s set pretty easily.

Looking forward to a fix! :)


Seth Hall
International Computer Science Institute
(Bro) because everyone has a network

More information about the Bro mailing list