Trellix Intrusion Prevention System doesn't parse Layer 7 data correctly

Technical Articles ID: KB93045
Last Modified: 2024-01-24 10:03:56 Etc/GMT

Environment

Trellix Intrusion Prevention System

Problem 1

When you view the attack log, you see that the Manager SM displays status codes as .1 200 instead of 200.

Packet captures report the HTTP Host header as empty. But, the Manager attack logs populate an incorrect HTTP Host field.

Cause

The Webserver doesn't send HTTP Requests in a proper format. When the Webserver sends a malformed request, it can't parse it.

For example:

GET /testweb/index.jsp HTTP1.1
Host:
Connection: close

In this request, you can see that the HTTP version in the GET request is HTTP1.1 instead of HTTP/1.1

Solution

The Manager is working as designed. If there are malformed HTTP requests, the Manager can't parse the information correctly.

Affected Products

Network Security Manager 11.x
Network Security Manager 10.x

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Portuguese Brasileiro

Knowledge Center

Trellix Intrusion Prevention System doesn't parse Layer 7 data correctly

Environment

Problem 1

Cause

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

Trellix Intrusion Prevention System doesn't parse Layer 7 data correctly

Environment

Problem 1

Cause

Solution

Affected Products

Languages:

Choose your region

Title

Title