Re: http_uri ... where does it end?

[David Means <w1t3h4t () gmail com>]

I can't really address how snort parses the stream, but GET is the
method,  /resources/text.css is the URI/URL, and HTTP/1.1 is the
version.  The version is optional.  Headers begin after the trailing
CRLF, following either the URI or the version.  If following the URI,
the version must not be present.

---
David Means



On Thu, Sep 23, 2010 at 11:35 AM, Jason Wallace
<jason.r.wallace () gmail com> wrote:
> For a web request like this...
>
> GET /resources/text.css HTTP/1.1
>
> GET is the http_method, but is HTTP/1.1 considered part of http_uri or
> http_header?
>
> thx,
> Wally
>
> ------------------------------------------------------------------------------
> Nokia and AT&T present the 2010 Calling All Innovators-North America contest
> Create new apps & games for the Nokia N8 for consumers in  U.S. and Canada
> $10 million total in prizes - $4M cash, 500 devices, nearly $6M in marketing
> Develop with Nokia Qt SDK, Web Runtime, or Java and Publish to Ovi Store
> http://p.sf.net/sfu/nokia-dev2dev
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs () lists sourceforge net
> https://lists.sourceforge.net/lists/listinfo/snort-sigs

------------------------------------------------------------------------------
Nokia and AT&T present the 2010 Calling All Innovators-North America contest
Create new apps & games for the Nokia N8 for consumers in  U.S. and Canada
$10 million total in prizes - $4M cash, 500 devices, nearly $6M in marketing
Develop with Nokia Qt SDK, Web Runtime, or Java and Publish to Ovi Store 
http://p.sf.net/sfu/nokia-dev2dev
_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs