Re: http body q.

Uhm! didn't notice that. Thanks for pointing out. Looks like my earlier
experiment on try.bro.org was with another server.
I am getting the same behavior now on my setup and try.bro.org setup with
the two pcaps.

On Tue, Jul 30, 2019 at 5:46 PM Jon Siwek <[email protected]> wrote:

> On Tue, Jul 30, 2019 at 4:04 PM Dk Jack <[email protected]> wrote:
>
> > However, in my cluster setup, the end_entity event from response body is
> coming first, then log-filter call, followed by end entity call for request.
>
> For the pcap you gave, it looks like that is actually the real order
> of the packets: the client is in the middle of sending the request
> body, but we see the server's OK response before the request is even
> finished (server also starts trying to reset connection at that
> point).  So seems like it's weirdness to blame on that particular HTTP
> server?  Or do you generally see this same pattern for other servers,
> too?
>
> - Jon
>

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek