HTTP::host is empty??

it returns the value of the host header, is it possible the request on that box just don't include one? or that there is a device somewhere close which strips the host header?

it returns the value of the host header, is it possible the request on that box just don't include one? or that there is a device somewhere close which strips the host header?

Jeremy, if a customer makes an HTTP/1.0 request, there will be no Host header.

Most clients will include a host header in HTTP 1.0, but it's not required until HTTP 1.1. You can check this by logging the [HTTP::version] and [HTTP::header User-Agent] values when [HTTP::host] eq "":

when HTTP_REQUEST {

 Log client details if the host header is empty
if {[HTTP::host] eq ""}{
log local0. "[IP::client_addr]:[TCP::client_port]: Null host header, HTTP [HTTP::version], U-A: [HTTP::header User-Agent]"
}
}

Aaron

Thanks for the suggestions. This behavior would happen on requests from the same browser and session, sometimes the host field is set, sometimes not. As it turns out, it appears that our web filter appliance is doing some crazy stuff and sniping packets here and there.

 

 

Thanks again.