This article applies to:
Question:
- What is the purpose of "Split Packet Detection"?
Reply:
The "Split Packet Detection" option is located in System -> Control -> Filter.
Enabling "Split Packet Detection" on the R3000 means it will look for packets that contain only "G" or "GE". This is a common way for applications to bypass filtering solutions as they attempt to hide the HTTP GET requests by splitting the keyword "GET" across two separate packets.
Notes:
The reason we introduced that setting was to address certain applications that were intentionally splitting an HTTP GET request across multiple packets so that content filters would not detect the request.
If you find this is causing overblocking, you can play with the byte size to prevent blocking your legitimate traffic, so that you can still take advantage of the feature without the overblocking.
A packet capture of a request to one of the legitimate sites being blocked would tell you what size packets are being used, and you could just set the byte size of "Split Packet Detection" option to be smaller than what you're observing on the legitimate site.
