[Zeek] Raw HTTP Headers

Andrew Klaus andrew at aklaus.ca
Sat Aug 24 21:32:40 PDT 2019


Hello,

I'd like to write a script for HTTP requests, but I need the raw and
untruncated headers to do this. I can't seem to find an event that will
give me this data to work with. I've looked at http_all_headers and
http_header, but they still strip whitespace.

Is there any (current) way of doing this? It'd be nice to be able to do
this without having to modify the analyzer.

Thanks!
Andrew
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/zeek/attachments/20190824/1f133582/attachment.html 


More information about the Zeek mailing list