Aw! Sorry to hear that. It's equally frustrating for us when people
run into problems that can't be fixed merely with scripts. Hopefully in
the future we'll have a better solution for you. Hopefull you can
figure out a different approach or some other script for the contest!
.Seth
On 27 Aug 2019, at 22:01, Andrew Klaus wrote:
Thanks Seth!
I was hoping to have a new Zeek script written for the Zeek contest,
but it
doesn't look like modules that need source code modifications will be
considered.
Andrew
On Tue, Aug 27, 2019 at 7:02 PM Seth Hall <seth(a)corelight.com> wrote:
> I believe that this isn't available since (as your already
> discovered),
> the analyzer strips whitespace. The only option would be to modify
> the
> analyzer or write a new one.
>
> .Seth
>
> On 25 Aug 2019, at 0:32, Andrew Klaus wrote:
>
>> Hello,
>>
>> I'd like to write a script for HTTP requests, but I need the raw and
>> untruncated headers to do this. I can't seem to find an event that
>> will
>> give me this data to work with. I've looked at http_all_headers and
>> http_header, but they still strip whitespace.
>>
>> Is there any (current) way of doing this? It'd be nice to be able to
>> do
>> this without having to modify the analyzer.
>>
>> Thanks!
>> Andrew
>> _______________________________________________
>> Zeek mailing list
>> zeek(a)zeek.org
>>
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
>
> --
> Seth Hall * Corelight, Inc *
www.corelight.com
>
--
Seth Hall * Corelight, Inc *
www.corelight.com