This article applies to:
Question:
What is HTTP Packet Splitting Detection setting and what does it do?
Reply
HTTP Packet Splitting Detection functionality is introduced in software version 2.0.12.10 to address a vulnerability that allows a user to break up HTTP requests across many small tcp packets. Packet splitting is usually accomplished using a third party application. When enabled, this option will allow you to configure the size of the packet for R3000 to detect (default is 48 bytes). With this option enabled, if R3000 detects a packet size equal or smaller than the specified size and the packet is an HTTP 1.1 request that contains a GET but no HOST header or vice versa, then request will be blocked as MALCOD or Malicious Code.
You can configure the packet size to as low as 5 bytes but please be aware that this may cause some over-blocking, so it is not recommended that this option be left 'on' or enabled by default but instead this is to be used in a specific case scenario where splitting is indeed taking place. The smaller the packet size is configured, the higher the chance of over-blocking.
- This article was previously published as:
- 8e6 KB 281966