[Bro-Dev] #647: SDCH support

Bro Tracker bro at tracker.bro-ids.org
Mon Oct 24 10:09:11 PDT 2011

#647: SDCH support
 Reporter:  seth     |      Owner:
     Type:  Problem  |     Status:  new
 Priority:  Normal   |  Milestone:  Bro1.6
Component:  Bro      |    Version:
 Keywords:           |
 When Chrome and other SDCH supporting http clients request content from
 SDCH compatible HTTP servers the response includes a header that looks
 like this:

 Content-Encoding: sdch,gzip

 Bro's HTTP analyzer doesn't currently do substring matches on the content-
 encoding header so the resulting sdch/gzip content is identified as gzip
 only.  Two things need to happen here:

     1. Support substring matches on the content-encoding header to
 identify that the content is gzip encoded.
     2. Support some notion of the SDCH protocol.

 I think that point 1 should be done for the 2.0 release  but point 2 can
 wait until later when we have a better notion of what SDCH support would

Ticket URL: <http://tracker.bro-ids.org/bro/ticket/647>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker

More information about the bro-dev mailing list