Project

General

Profile

Actions

Documentation #5485

open

Documentation #5182: userguide: better document rule keywords

userguide: explain that the http.header_names buffer is normalized

Added by Juliana Fajardini Reichow 11 days ago. Updated 8 days ago.

Status:
New
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

libhtp normalizes the http.header_names buffer, as it resides in a structure that does not allow duplicates.

As someone inspecting Wireshark packet traffic may be expecting something different when writing a rule, make this behavior clear on our documentation.

Actions #1

Updated by Juliana Fajardini Reichow 11 days ago

  • Parent task set to #5182
Actions #2

Updated by Juliana Fajardini Reichow 8 days ago

  • Subject changed from userguide: explain that the http.header_names is normalized to userguide: explain that the http.header_names buffer is normalized
Actions

Also available in: Atom PDF