Actions
Task #3559
closedTask #3553: Tracking: enable GAP recovery for all TCP app-layer protocols
http: support GAP recovery
Effort:
Difficulty:
Label:
Protocol
Description
In HTTP we can deal with GAPs in various ways
- if there is a content length set and we are in the body parsing, we can simply skip this part of the body. For file extraction the SMB parser can serve as an example
- it would be useful to be able to communicate the CL to the stream engine so we might know where the next record/tx starts.
- bruteforce search for the next record/tx as a fallback
Actions