Using HTTP::payload with/without HTTP::collect/HTTP_REQUEST_DATA?

Thanks for the info, Spark. Do you think there are scenarios where it's practical to modify the HTTP payload without collecting it?

 

 

I guess you could get a way with not collecting the payload if you knew the data you wanted to modify was always in the first packet. But it seems like to be safe you'd still need to always collect the full payload. I'll need to do some testing and see what happens if you modify the current HTTP::payload in HTTP_REQUEST or HTTP_RESPONSE and then the peer sends more than packets.

 

 

Aaron