HTTP inspector
Snort 3 supports two HTTP inspectors: http_inspect and http2_inspect. We will look at both inspectors in this section.
The HTTP Inspect (inspector) module analyzes the HTTP requests and responses. The module depends on the Stream TCP inspector to provide TCP data as a continuous (reassembled) stream of bytes. The module has a splitter component – HTTPStreamSplitter – that divides the TCP stream into HTTP protocol data units (PDUs). The HTTP PDUs are individual HTTP requests and responses. The operation of the HTTP Inspector module is shown at a high level in Figure 10.1:
Figure 10.1 – The stream_tcp module provides a stream of bytes to the HTTP inspector, which divides into HTTP PDUs
The HTTP inspector analyzes, parses, and makes available the HTTP message in sections. Subsequently, the following message sections of an HTTP request are available to be matched against for detection:
- Request line: This is the...
