[Bro-Dev] #809: HTTP file extraction not correct

[Bro Tracker]

#809: HTTP file extraction not correct
--------------------+---------------------
 Reporter:  dalton  |       Type:  Problem
   Status:  new     |   Priority:  Normal
Milestone:          |  Component:  Bro
  Version:  2.0     |   Keywords:  HTTP
--------------------+---------------------
 I'm trying to use BRO to look at some pipelined HTTP traffic.  I'm asking
 for file extraction but one of the extracted files is the wrong size.  In
 the attached pcap, packet #225 shows the content length as 41931.  In the
 http.log file, I see this:



 1312412117.323323       d8RHszXqnfi     192.168.123.105 37621
 74.208.60.21    80      7       GET     crev.info
 /images/interface/resources.png http://crev.info/       Mozilla/5.0
 (Linux; U; Android 2.2.1; en-us; HTC Dream Build/FRG83) AppleWebKit/533.1
 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1       0
 '''41931'''   200     OK      -       -       -       (empty) -       -
 -       image/png       -       http-
 item_192.168.123.105:37621-74.208.60.21:80_resp_7.dat

 1312412117.710518       d8RHszXqnfi     192.168.123.105 37621
 74.208.60.21    80      8       GET     crev.info
 /images/interface/navbar_li.png http://crev.info/       Mozilla/5.0
 (Linux; U; Android 2.2.1; en-us; HTC Dream Build/FRG83) AppleWebKit/533.1
 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1       0       928
 200     OK      -       -       -       (empty) -       -       -
 application/octet-stream        -       http-
 item_192.168.123.105:37621-74.208.60.21:80_resp_7.dat



 output dir listing:

 ----

 -rw-r--r--  1 dporter dporter   1150 2012-04-10 21:59 http-
 item_192.168.123.105:37621-74.208.60.21:80_resp_10.dat
 -rw-r--r--  1 dporter dporter  60901 2012-04-10 21:59 http-
 item_192.168.123.105:37621-74.208.60.21:80_resp_1.dat
 -rw-r--r--  1 dporter dporter  72217 2012-04-10 21:59 http-
 item_192.168.123.105:37621-74.208.60.21:80_resp_2.dat
 -rw-r--r--  1 dporter dporter    330 2012-04-10 21:59 http-
 item_192.168.123.105:37621-74.208.60.21:80_resp_3.dat
 -rw-r--r--  1 dporter dporter    851 2012-04-10 21:59 http-
 item_192.168.123.105:37621-74.208.60.21:80_resp_4.dat
 -rw-r--r--  1 dporter dporter    716 2012-04-10 21:59 http-
 item_192.168.123.105:37621-74.208.60.21:80_resp_5.dat
 -rw-r--r--  1 dporter dporter   3408 2012-04-10 21:59 http-
 item_192.168.123.105:37621-74.208.60.21:80_resp_6.dat
 -rw-r--r--  1 dporter dporter  '''32931''' 2012-04-10 21:59 http-
 item_192.168.123.105:37621-74.208.60.21:80_resp_7.dat
 -rw-r--r--  1 dporter dporter 771040 2012-04-10 21:59 http-
 item_192.168.123.105:37621-74.208.60.21:80_resp_9.dat

 ----






 The content length is correct in http.log, but the output file
 (..._resp_7) has length 32931.

 Also, why does http.log indicate that both resources.png AND navbar_li.png
 are both written to resp_7.dat ?



 The results from xplico and wireshark when run on this pcap file look
 correct to me.

-- 
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/809>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker