Hello,
I’d like to write a script for HTTP requests, but I need the raw and untruncated headers to do this. I can’t seem to find an event that will give me this data to work with. I’ve looked at http_all_headers and http_header, but they still strip whitespace.
Is there any (current) way of doing this? It’d be nice to be able to do this without having to modify the analyzer.
Thanks!
Andrew
I believe that this isn't available since (as your already discovered), the analyzer strips whitespace. The only option would be to modify the analyzer or write a new one.
.Seth
Thanks Seth!
I was hoping to have a new Zeek script written for the Zeek contest, but it doesn’t look like modules that need source code modifications will be considered.
Andrew
Aw! Sorry to hear that. It's equally frustrating for us when people run into problems that can't be fixed merely with scripts. Hopefully in the future we'll have a better solution for you. Hopefull you can figure out a different approach or some other script for the contest!
.Seth