[Bro-Dev] [JIRA] (BIT-725) Incorrect weird (unmatched_HTTP_reply) in the HTTP analyzer.

Jon Siwek (JIRA) jira at bro-tracker.atlassian.net
Fri Mar 20 09:15:00 PDT 2015


     [ https://bro-tracker.atlassian.net/browse/BIT-725?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Jon Siwek updated BIT-725:
--------------------------
    Resolution: Fixed
        Status: Closed  (was: Open)

> Incorrect weird (unmatched_HTTP_reply) in the HTTP analyzer.
> ------------------------------------------------------------
>
>                 Key: BIT-725
>                 URL: https://bro-tracker.atlassian.net/browse/BIT-725
>             Project: Bro Issue Tracker
>          Issue Type: Problem
>          Components: Bro
>            Reporter: Seth Hall
>            Assignee: Jon Siwek
>              Labels: analyzer
>             Fix For: 2.4
>
>         Attachments: http-request-timeout.trace
>
>
> The HTTP analyzer is rasing the unmatched_HTTP_reply weird if it sees a response that there was no packet for.  There are cases where this is legit and the case is handled correctly by the new http scripts so the weird should probably be removed since it's really just noise.  I'll attach a tracefile that shows a legit response-only connection.



--
This message was sent by Atlassian JIRA
(v6.4-OD-15-055#64014)


More information about the bro-dev mailing list