# \[EXT\]  HTTP/2 analyzer

**URL:** <https://community.zeek.org/t/ext-http-2-analyzer/5814>\
**Category:** Zeek\
**Created:** [August 21, 2019, 6:09pm UTC](https://community.zeek.org/t/ext-http-2-analyzer/5814 "2019-08-21T18:09:50Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Khan\_Murad\_A](https://avatars.discourse-cdn.com/v4/letter/k/439d5e/32.png) [@Khan\_Murad\_A](https://community.zeek.org/u/Khan_Murad_A)\
**Post date:** [August 21, 2019, 6:09pm UTC](https://community.zeek.org/t/ext-http-2-analyzer/5814/1 "2019-08-21T18:09:50Z")

</div>

Afaik, the Palo’s downgrade traffic to HTTP 1.1 by manipulating the TLS exchange – so you might not even see any HTTP/2 traffic. Iirc adding support for HTTP/2 was on their roadmap but not a high priority.

You can check if you actually have HTTP/2 negotiated connections by monitoring the pre-decrypted traffic and looking for the negotiated protocol in the ssl.log. The ALPN designator for standard http2 is ‘h2’.

---

<div class="post-metadata">

**Author:** ![ericooi](https://avatars.discourse-cdn.com/v4/letter/e/ecae2f/32.png) [@ericooi](https://community.zeek.org/u/ericooi)\
**Post date:** [August 21, 2019, 6:39pm UTC](https://community.zeek.org/t/ext-http-2-analyzer/5814/2 "2019-08-21T18:39:06Z")

</div>

Thanks, Murad! I checked ssl.log and do see a good amount of traffic with “h2” listed, so it looks like I’m definitely seeing this on my network.

Only reason I believe that Palo is still sending it as HTTP/2 traffic is because the monitor tab has a “HTTP/2 Connection Session ID” and each line entry that has a non-zero value for that field seems to be missing a corresponding log in Zeek. Whereas anytime there’s a zero value in that column, presumably denoting HTTP/1.1 traffic, Zeek is able to analyze it successfully.

It’s not a big deal, but I was so excited to have Zeek analyze my decrypted traffic only to find that most of it is HTTP/2. I suppose I’ll wait for the official analyzer or learn how to write one myself. 😛

Thanks,  
Eric

---

<div class="post-metadata">

**Author:** ![Khan\_Murad\_A](https://avatars.discourse-cdn.com/v4/letter/k/439d5e/32.png) [@Khan\_Murad\_A](https://community.zeek.org/u/Khan_Murad_A)\
**Post date:** [August 21, 2019, 6:54pm UTC](https://community.zeek.org/t/ext-http-2-analyzer/5814/3 "2019-08-21T18:54:54Z")

</div>

Weird. I’d recommend opening an issue on github, if you can. Ideally, if you can provide a pcap, it’ll help with troubleshooting. But there are other things we can check.

---

<div class="post-metadata">

**Author:** ![ericooi](https://avatars.discourse-cdn.com/v4/letter/e/ecae2f/32.png) [@ericooi](https://community.zeek.org/u/ericooi)\
**Post date:** [August 21, 2019, 7:39pm UTC](https://community.zeek.org/t/ext-http-2-analyzer/5814/4 "2019-08-21T19:39:48Z")

</div>

Thanks, Murad. I just found the option in Palo Alto to force the downgrade to HTTP/1.1 and Zeek is now seeing that traffic, thanks for the tip. I’ll still try to grab a PCAP of HTTP/2 traffic and see if I can open an issue.

---

<div class="post-metadata">

**Author:** ![ericooi](https://avatars.discourse-cdn.com/v4/letter/e/ecae2f/32.png) [@ericooi](https://community.zeek.org/u/ericooi)\
**Post date:** [August 26, 2019, 5:55pm UTC](https://community.zeek.org/t/ext-http-2-analyzer/5814/5 "2019-08-26T17:55:06Z")

</div>

Just submitted — [https://github.com/MITRECND/bro-http2/issues/6](https://github.com/MITRECND/bro-http2/issues/6)

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/ext-http-2-analyzer/5814/6 "2022-05-06T15:46:43Z")

</div>