Extract headers from TCP payload
Hi, I have VS without http profile, but it can process http traffic. When using TCP::collect I am getting something like that in TCP::payload "GET /?ip=10.20.10.2 HTTP/1.1 Accept: image/jpeg, image/gif, image/pjpeg, application/x-ms-application, application/xaml+xml, application/x-ms-xbap, / Accept-Language: en-US User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; vWorkspace) Accept-Encoding: gzip, deflate Host: wpad.test.com Connection: Keep-Alive " - don't know why no \r\n here? findstr $str "Host: " 6 - do not terminate on end of line, so it returns "wpad.test.com Connection: Keep-Alive " - obviously because how TCP::payload is presented as a string. What could be used to reliably extract only host from Host header? To retrieve method and URI scan [TCP::payload] {%[^ /]%s} method uri seems to be working ok Now the question is if findstr and scan methods are correct here, or it could be implemented more elegant/efficient? Piotr
Extract headers from TCP payload
Hi, I have VS without http profile, but it can process http traffic. When using TCP::collect I am getting something like that in TCP::payload "GET /?ip=10.20.10.2 HTTP/1.1 Accept: image/jpeg, image/gif, image/pjpeg, application/x-ms-application, application/xaml+xml, application/x-ms-xbap, / Accept-Language: en-US User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E; vWorkspace) Accept-Encoding: gzip, deflate Host: wpad.test.com Connection: Keep-Alive " - don't know why no \r\n here? findstr $str "Host: " 6 - do not terminate on end of line, so it returns "wpad.test.com Connection: Keep-Alive " - obviously because how TCP::payload is presented as a string. What could be used to reliably extract only host from Host header? To retrieve method and URI scan [TCP::payload] {%[^ /]%s} method uri seems to be working ok Now the question is if findstr and scan methods are correct here, or it could be implemented more elegant/efficient? Piotr