Forum Discussion
jonathan_239725
Nimbostratus
NimbostratusStream expression for TCP payload
So I have been trying to find the most efficient way to detect string patterns within HTTP payloads. I have found out the best way to tackle this (from what I know so far) is to use a stream profile...
Certainly if HTTP compression is enabled, you will not be able to detect a string that is part of the HTTP payload unless you decompress first. (Same if it is SSL encrypted - you have to terminate SSL first.)