Re: Raw HTTP Headers

I believe that this isn't available since (as your already discovered), 
the analyzer strips whitespace.  The only option would be to modify the 
analyzer or write a new one.

   .Seth

On 25 Aug 2019, at 0:32, Andrew Klaus wrote:

> Hello,
>
> I'd like to write a script for HTTP requests, but I need the raw and
> untruncated headers to do this. I can't seem to find an event that 
> will
> give me this data to work with. I've looked at http_all_headers and
> http_header, but they still strip whitespace.
>
> Is there any (current) way of doing this? It'd be nice to be able to 
> do
> this without having to modify the analyzer.
>
> Thanks!
> Andrew
> _______________________________________________
> Zeek mailing list
> [email protected]
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek

--
Seth Hall * Corelight, Inc * www.corelight.com
_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek