Forum Discussion
Oz_Ayd_69699
Nimbostratus
NimbostratusHTTP::collect - performance issue
I have a simple rule with a basic HTTP:collect statement in the HTTP_REQUEST event. When, the HTTP::collect statement is executed, it takes a considerable amount of time (200+ milliseconds) to fire th...
Yes you have to be careful with using collect on POST especially if the client issues an Expect: 100-Continue header. In such case, the client is will only send the POST data if it gets a 100 Continue response from the server or if it times out; which explains the 200ms delay on your client.
I remeber some one posting a rule that did a TCP::respond with a 100 Continue and stripped the continue headers. This can be tricky because a) you might not know if the server will accept the POST and b) we have seen IIS servers send unsolicited 100 Continue.
