Documentation #5485
open
Documentation #5182: userguide: better document rule keywords
userguide: explain that the http.header_names buffer is normalized
Added by Juliana Fajardini Reichow over 2 years ago.
Updated 7 months ago.
Description
libhtp normalizes the http.header_names buffer, as it resides in a structure that does not allow duplicates.
As someone inspecting Wireshark packet traffic may be expecting something different when writing a rule, make this behavior clear on our documentation.
Related issues
1 (1 open — 0 closed)
- Subject changed from userguide: explain that the http.header_names is normalized to userguide: explain that the http.header_names buffer is normalized
- Assignee changed from OISF Dev to Jason Taylor
This will be/is resolved with the work being done on ticket #3025
looks like #6779 might be a duplicate of this.
- Related to Bug #6779: http.header_names behavior when encountering duplicate header names added
- Status changed from New to Assigned
- Target version changed from TBD to 8.0.0-beta1
Also available in: Atom
PDF