Identifying ASM signatures affecting responses?

Env: LTM 11.5.2 with ASM

 

We have a security profile which appears to be affecting responses for a small set of requests, without reporting any error or block in the ASM event log. This is a REST call that accespts JSON input data, retreieves data from a database, and returns the data results as JSON.

 

When we run the query for a userid that returns a small result, there is no issue. But when we use a different userid that has more data, the client never receives the response (not a single byte gets returned, at the network level). Nevertheless, the response appears in the ASM event log (though at the top of the response content display it says "Response was truncated"), and I see content displayed, as if it had been sent back. The size of the response that has an issue isn't huge (about 15K).

 

We have only one entry in our Parameter List for this policy, "*" of type User-input value. We turned off both Value and Name meta-characters checks, just in case, with no effect. However, when we turn off signature checks for the parameter, the problem goes away.

 

So, our assumption is that some signature is processing the response, and freezing, or some other way affecting the stream going back to the client, such that bytes never get sent. But it's happening with no indication in the ASM event log.

 

How can we identify what signature is the culprit? Is there a way to search just the signatures that parse responses, vs. request data? (the Advanced filter lumps Request/Response together). Is there any advanced ASM signature processing logging that we can turn on, anything like that?

 

And any other thoughts on what the cause might be would be appreciated. I don't think it's size related, as the max_html setting in advanced. I thought maybe chunking, but Transfer-Encoding: chunked is appearing in both working and non-working responses. Hmm ....