Lorn
Apr 26, 2013Nimbostratus
HTTP collect not working when POST is multiple TCP segments
When attempting to collect and parse data from the payload of an HTTP post, the HTTP collect command fails to gather any data when the HTTP request is across multiple TCP segments. If the HTTP request is a single TCP segment it works fine. Is this expected behavior and is there a workaround?
when HTTP_REQUEST {
if {[HTTP::header "Content-Length"] ne "" && [HTTP::header "Content-Length"] <= 1000}{
set content_length [HTTP::header "Content-Length"]
} else {
set content_length 1000
}
log local0.info "Content Length = $content_length"
if { $content_length > 0}{
log local0.info "Begin http collect content Length is $content_length"
HTTP::collect $content_length
if { [HTTP::payload] eq ""}{
log local0.info "No Payload"
HTTP::release
}
}
}
when HTTP_REQUEST_DATA {
log local0.info "Begin http request data"
set payload [HTTP::payload]
log local0.info "$payload"
}