# Problem in using 'http-request-header' in Signatures

**URL:** <https://community.zeek.org/t/problem-in-using-http-request-header-in-signatures/1023>\
**Category:** Zeek\
**Created:** [September 26, 2006, 9:11am UTC](https://community.zeek.org/t/problem-in-using-http-request-header-in-signatures/1023 "2006-09-26T09:11:01Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jaya\_Dhanesh](https://avatars.discourse-cdn.com/v4/letter/j/7feea3/32.png) [@Jaya\_Dhanesh](https://community.zeek.org/u/Jaya_Dhanesh)\
**Post date:** [September 26, 2006, 9:11am UTC](https://community.zeek.org/t/problem-in-using-http-request-header-in-signatures/1023/1 "2006-09-26T09:11:01Z")

</div>

Hi,

I was trying to write signatures for detecting connections to a mail server.  
I used  
'http-request-header' followed by the payload to be matched.

&nbsp;&nbsp;signature abcd  
&nbsp;&nbsp;{  
&nbsp;&nbsp;&nbsp;&nbsp;ip-proto == tcp  
&nbsp;&nbsp;&nbsp;&nbsp;tcp state established  
&nbsp;&nbsp;&nbsp;&nbsp;event "Connection to Mail server"  
&nbsp;&nbsp;&nbsp;&nbsp;http-request-header /.\*mail/  
&nbsp;&nbsp;}

When I tried to start bro, I got the following error message:  
"parse error at line x:" i.e., at the line where i have mentioned  
http-request-header.  
I did load the analyzers.

Can anyone suggest a way to handle this problem.

Thanks,  
Dhanesh.

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [September 26, 2006, 8:22pm UTC](https://community.zeek.org/t/problem-in-using-http-request-header-in-signatures/1023/2 "2006-09-26T20:22:14Z")

</div>

Oh, I'm sorry about that. The documentation talks about  
http-request-header but it appears that the code for it never made  
it into the distribution. I recall that I implemented this a long  
time ago but somehow it got lost.

So for the time being, this functionality is actually not there. If  
you depend on it, it wouldn't be to difficult to add it again  
though.

Robin

---

<div class="post-metadata">

**Author:** ![Jaya\_Dhanesh](https://avatars.discourse-cdn.com/v4/letter/j/7feea3/32.png) [@Jaya\_Dhanesh](https://community.zeek.org/u/Jaya_Dhanesh)\
**Post date:** [September 27, 2006, 4:47am UTC](https://community.zeek.org/t/problem-in-using-http-request-header-in-signatures/1023/3 "2006-09-27T04:47:53Z")

</div>

> Oh, I'm sorry about that.

Thats OK.

> If you depend on it, it wouldn't be to difficult to add it again  
> though.

Thats good. Can you suggest me how to add it?

Thanks,  
Dhanesh.

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [September 27, 2006, 4:37pm UTC](https://community.zeek.org/t/problem-in-using-http-request-header-in-signatures/1023/4 "2006-09-27T16:37:56Z")

</div>

If you give me a few days, I'll take a look at it.

However, if you really want to give it a try yourself (which is  
always appreciated!), grep for "Rule::HTTP" across the source to see  
how it is done for HTTP URLs (the "http" signature keyword).  
http-request-header can be added in a similar fashion.

Robin

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:37pm UTC](https://community.zeek.org/t/problem-in-using-http-request-header-in-signatures/1023/5 "2022-05-06T15:37:58Z")

</div>