This article applies to:
Question:
Blocked by a 'GET' in Probes
Reply
If you are getting a site blocked and run a probe, and then see a 'GET' as below, you probably have Packet Splitting Detection 'ON'.
To view your current settings, go to System>Control>Filter and look for HTTP Packet Splitting feature.
10.30.27.157,IPGROUP,2008/12/02,21:53:14,MALCOD,1,2,GET,,http://60.33.145.194/
HTTP Packet Splitting Detection functionality is introduced in software version 2.0.12.10 to address a vulnerability that allows a user to break up HTTP requests across many small tcp packets. Packet splitting is usually accomplished using a third party application. When enabled, this option will allow you to configure the size of the packet for R3000 to detect (default is 48 bytes). With this option enabled, if R3000 detects a packet size equal or smaller than the specified size and the packet is an HTTP 1.1 request that contains a GET but no HOST header or vice versa, then request will be blocked as MALCOD or Malicious Code.
You can configure the packet size to as low as 5 bytes but please be aware that this may cause some overblocking, so it is not recommended that this option be left 'ON' or enabled by default but instead this is to be used in a specific case scenario where splitting is indeed taking place. The smaller the packet size is configured, the higher the chance of overblocking.
- This article was previously published as:
- 8e6 KB 300135