http response encoded length ?

Zeek
1

Hi,
How can I get the length of an http response that is gzip ENcoded and where the response does not have a “content-length” header?
It seems that stat$body_length has the length of the DEcoded data.

Thanks.

2

I don't believe that data is available right now. What do you need it for?

  .Seth

3

Ah! Ok, that's available but you have to be aware of what you are measuring. In your conn.log there are several fields that represent the data you're looking for.

orig_bytes, resp_bytes
These are payload bytes for data sent by the originator and responder.

orig_ip_bytes, resp_ip_bytes
These are byte counts including the IP header. If you are looking for the total amount of data being sent across your border to the "internet", then this is likely the measurement you want.

These fields available several ways, one easy way that is a nice analog to log processing is to access it through the logging framework event as the data is being logged.

event Conn::log_conn(rec: Conn::Info)
  {
  print rec$orig_ip_bytes + rec$resp_ip_bytes;
  }

  .Seth