(http_inspect) INVALID CHUNK SIZE OR CHUNK SIZE FOLLOWED BY JUNK CHARACTERS

The rule is designed to trigger an alert when it detects invalid chunked data in the HTTP response during a chunked transfer encoding scenario. This can happen if the server sends an HTTP response with chunked data that does not adhere to the proper syntax or format required for chunked transfer encoding. Invalid chunked data in an HTTP response could indicate potential issues or anomalies in the server's response.

ID Number

0000023

Signature

alert ( msg: "HI_CLISRV_INVALID_CHUNKED"; sid: 23; gid: 120; rev: 1; metadata: policy max-detect-ips drop, rule-type preproc ; classtype:bad-unknown; )

MITRE ATT&CK Technique

-

Severity

Low

Recommendations/Investigative actions

Can be disabled will trigger many False Positives