[Bro] HTTP Object length calculation

[Gregor Maier]

On 9/13/11 16:17 , Ioannis WiCom wrote:
> When the host receives the full object and it is encoded, bro reports
> the size of the object in the server (before compression), not the
> actual bytes in the network (after compression).

Correct.

> When the object is partially downloaded (object_length<content_length)
> and assuming it was encoded, bro reports the actual bytes in the network
> (since partial decompression cannot be performed).

No, the compression schemes can be done on the fly. I.e., decompression 
can start before the whole object is downloaded. That's what Bro is 
doing. So if an encoded transfer is interrupted, Bro will report the 
amount of bytes it has decompressed so far.

> Is there a way to get the actual bytes transferred?

Unfortunately not.


cu
gregor
-- 
Gregor Maier
<gregor at icir.org>  <gregor at icsi.berkeley.edu>
Int. Computer Science Institute (ICSI)
1947 Center St., Ste. 600
Berkeley, CA 94704, USA
http://www.icir.org/gregor/