[Bro-Dev] [JIRA] (BIT-1257) Same file id generated for potentially different files

[Jimmy Jones (JIRA)]

    [ https://bro-tracker.atlassian.net/browse/BIT-1257?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18211#comment-18211 ] 

Jimmy Jones commented on BIT-1257:
----------------------------------

{noformat}
[ 30%] core.tunnels.gtp.outer_ip_frag ... failed
{noformat}
http.log resp_fuids different, as expected
{noformat}
[ 66%] scripts.base.frameworks.file-analysis.bifs.set_timeout_interval ... failed
{noformat}
http/206_example_b.pcap, multiple requests were being incorrectly merged into one, but don't quite understand the output before (or after!)
{noformat}
[ 67%] scripts.base.frameworks.file-analysis.http.partial-content ... failed
{noformat}
http/206_example_a.pcap, multiple requests were being incorrectly merged into one, are now split into two files with the correct number of bytes. Now get FILE_TIMEOUT events, not sure why.

> Same file id generated for potentially different files
> ------------------------------------------------------
>
>                 Key: BIT-1257
>                 URL: https://bro-tracker.atlassian.net/browse/BIT-1257
>             Project: Bro Issue Tracker
>          Issue Type: Problem
>          Components: Bro
>    Affects Versions: git/master, 2.3
>         Environment: CentOS 6
>            Reporter: Jimmy Jones
>         Attachments: fa.bro, sample-samefileid.pcap
>
>
> Attached sample contains two HTTP downloads of the same URL from the same client, but there are no guarantees that the files is actually the same (no Etags etc - in this case it actually is the same, but lets pretend they were different...). However the file analysis framework seems to give the same file ID in file_name and file_chunk for both downloads.
> Think this is something to do with Range requests as doesn't happen if do "normal" HTTP requests.



--
This message was sent by Atlassian JIRA
(v6.4-OD-05-009#64003)