Re: Sometimes HTTP.log fails to generate from PCAP file

On Thu, Aug 8, 2019 at 12:44 PM Jonah Burgess <[email protected]> wrote:

> Can anybody confirm why the HTTP.log fails to generate (is it the missing SYN-ACK at the start?)

Yes, that's likely the reason -- the HTTP parser (or any parser
really) don't make an attempt to (re)synchronize with the HTTP
protocol in the case we may be starting somewhere in the middle of the
TCP stream.

> and advise if there is some way I can still extract the HTTP traffic from the PCAP using Bro (since it’s clearly all visible in Wireshark).

Not out of the box, but attached is a patch that removes the checks
which currently cause the HTTP analysis to be skipped for such
connections. If all that's missing is the TCP handshake, then the
http.log produced with the patched version I think will be the same or
similar enough to if the handshake were there.  If there's more
packets missing than that, it will likely still fail to parse out much
HTTP data.

- Jon

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek

diff --git a/src/analyzer/protocol/http/HTTP.cc b/src/analyzer/protocol/http/HTTP.cc
index 1dbdcf9bd..10c368e84 100644
--- a/src/analyzer/protocol/http/HTTP.cc
+++ b/src/analyzer/protocol/http/HTTP.cc
@@ -863,7 +863,6 @@ HTTP_Analyzer::HTTP_Analyzer(Connection* conn)
 	AddSupportAnalyzer(content_line_orig);
 
 	content_line_resp = new tcp::ContentLine_Analyzer(conn, false);
-	content_line_resp->SetSkipPartial(true);
 	AddSupportAnalyzer(content_line_resp);
 	}
 
@@ -912,9 +911,6 @@ void HTTP_Analyzer::DeliverStream(int len, const u_char* data, bool is_orig)
 	{
 	tcp::TCP_ApplicationAnalyzer::DeliverStream(len, data, is_orig);
 
-	if ( TCP() && TCP()->IsPartial() )
-		return;
-
 	if ( upgraded )
 		return;