FPs Sig 5545 subsig 1 - HTTP Request Smuggling

[jkell]

This signature FPs on a particular client POST, see attached text for examples.

[jlimbo]

Could you provide some traffic samples of the entire http session. We would like to look into this further to improve this signature.

Thanks,

Jonathan

[jkell]

Well, for signature actions I see the checkbox for "Log Pair Packets" but my version seems to be missing the "Log Pair Packets Retroactively" option.

Is this a command-line only option? :-)

If they start to show up again, I'll try to correlate a capture.