[Bro-Dev] #698: HTTP vs MIME events

Bro Tracker bro at tracker.bro-ids.org
Mon Nov 28 14:59:57 PST 2011

#698: HTTP vs MIME events
 Reporter:  robin    |      Owner:
     Type:  Problem  |     Status:  new
 Priority:  Normal   |  Milestone:
Component:  Bro      |    Version:
 Keywords:  cleanup  |
 The way the ``mime_*`` and ``http_entity_*`` events are structure is a

 - First, I think we should have only a single set of events for all MIME

 - the ``mime_*`` events don't come with ``is_orig``.

 - ``http_header`` vs. ``mime_one_header``

 - ``http_entity_data`` delivers segments of size
 ``http_entity_data_delivery_size`` while ``mime_entity_data`` delivers
 complete entities (and ``mime_segment_data`` delivers segments…)

 - There are further inconsistencies I didn't record.

Ticket URL: <http://tracker.bro-ids.org/bro/ticket/698>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker

More information about the bro-dev mailing list