Project

General

Profile

Actions
Copy link

Bug #1946

closed

can't get response info in some situation

Added by wilson green almost 8 years ago. Updated almost 8 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Victor Julien
Target version:
3.2.1
Affected Versions:
Effort:
Difficulty:
Label:

Description

can't get http response in some situation.,and the http log show 

 "status":"-","ResponseBytes":"0"

the function HttpGetResponseLine(),HttpGetRawResponseHeaders(),HttpGetResponseBody() are get null.

The http request and response are:
GET /teamlog/worklog-data/showSharedPeople/ HTTP/1.1
Host: sn.xxxx.com:8080
Connection: keep-alive
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.87 Safari/537.36
DNT: 1
Referer: http://sn.xxxx.com:8080/teamlog/worklog/
Accept-Encoding: gzip, deflate, sdch
Accept-Language: zh,zh-CN;q=0.8,en-US;q=0.6,en;q=0.4,zh-TW;q=0.2,de;q=0.2
Cookie: JSESSIONID=9376EF8E2A0FCF00C07A309BCC59827B; TeamLog=5c5eff95a1cc1d3514899209562e852e;

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Type: application/json;charset=UTF-8
Content-Language: zh-CN
Transfer-Encoding: chunked
Date: Wed, 09 Nov 2016 06:47:50 GMT

[{"shared":1,"id":2,"username":"......"},{"shared":1,"id":7,"username":"........."},{"shared":0,"id":1,"username":"admin"},{"shared":0,"id":3,"username":"......"},{"shared":0,"id":9,"username":"........."}]

All the http log :

{"timestamp":"11/08/16-19:56:20.432093","UA":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.87 Safari/537.36","X-Forwarded-For":"-","Referer":"-","Cookie":"JSESSIONID=E9C3B12FCE7419C3507E308AFF27526A; _pcid_=d397a8bb9eca4f0782103f9a27d6139e; Hm_lvt_67f90644532efbe0383b928e0af775fa=1465984181; QCOOKIE=323431383632373138302c323431383638333134342c; __utma=15969214.1934399813.1467100157.1467103120.1469852869.3; __utmz=15969214.1467100157.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); csrftoken=2IOphx0cuqfmxZVzujUbNCxokbR9veRA; auth_token=f2f5bf820b1e822012bdef0681b260cc3454e1ca","Protocol":"HTTP/1.1","Method":"GET","hostame":"sn.xxxx.com","URL":"/teamlog/","status":"302","ResponseBytes":"0","clientIP":"172.19.100.133","clientPort":55406,"serverIP":"172.17.106.190","serverPort":8080}
{"timestamp":"11/08/16-19:56:20.444820","UA":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.87 Safari/537.36","X-Forwarded-For":"-","Referer":"-","Cookie":"JSESSIONID=53192C23E69C63D3C51B36E759C13DC1; _pcid_=d397a8bb9eca4f0782103f9a27d6139e; Hm_lvt_67f90644532efbe0383b928e0af775fa=1465984181; QCOOKIE=323431383632373138302c323431383638333134342c; __utma=15969214.1934399813.1467100157.1467103120.1469852869.3; __utmz=15969214.1467100157.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); csrftoken=2IOphx0cuqfmxZVzujUbNCxokbR9veRA; auth_token=f2f5bf820b1e822012bdef0681b260cc3454e1ca","Protocol":"HTTP/1.1","Method":"GET","hostame":"sn.xxxx.com","URL":"/teamlog/worklog","status":"302","ResponseBytes":"0","clientIP":"172.19.100.133","clientPort":55406,"serverIP":"172.17.106.190","serverPort":8080}
{"timestamp":"11/08/16-19:56:20.454456","UA":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.87 Safari/537.36","X-Forwarded-For":"-","Referer":"-","Cookie":"JSESSIONID=53192C23E69C63D3C51B36E759C13DC1; _pcid_=d397a8bb9eca4f0782103f9a27d6139e; Hm_lvt_67f90644532efbe0383b928e0af775fa=1465984181; QCOOKIE=323431383632373138302c323431383638333134342c; __utma=15969214.1934399813.1467100157.1467103120.1469852869.3; __utmz=15969214.1467100157.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); csrftoken=2IOphx0cuqfmxZVzujUbNCxokbR9veRA; auth_token=f2f5bf820b1e822012bdef0681b260cc3454e1ca","Protocol":"HTTP/1.1","Method":"GET","hostame":"sn.xxxx.com","URL":"/teamlog/worklog/","status":"302","ResponseBytes":"0","clientIP":"172.19.100.133","clientPort":55406,"serverIP":"172.17.106.190","serverPort":8080}
{"timestamp":"11/08/16-19:56:20.471967","UA":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.87 Safari/537.36","X-Forwarded-For":"-","Referer":"-","Cookie":"JSESSIONID=53192C23E69C63D3C51B36E759C13DC1; _pcid_=d397a8bb9eca4f0782103f9a27d6139e; Hm_lvt_67f90644532efbe0383b928e0af775fa=1465984181; QCOOKIE=323431383632373138302c323431383638333134342c; __utma=15969214.1934399813.1467100157.1467103120.1469852869.3; __utmz=15969214.1467100157.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); csrftoken=2IOphx0cuqfmxZVzujUbNCxokbR9veRA; auth_token=f2f5bf820b1e822012bdef0681b260cc3454e1ca","Protocol":"HTTP/1.1","Method":"GET","hostame":"sn.xxxx.com","URL":"/teamlog/login/%2Fworklog%2F","status":"200","ResponseBytes":"5121","clientIP":"172.19.100.133","clientPort":55406,"serverIP":"172.17.106.190","serverPort":8080}
{"timestamp":"11/08/16-19:56:29.663941","UA":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.87 Safari/537.36","X-Forwarded-For":"-","Referer":"http://sn.xxxx.com:8080/teamlog/login/%2Fworklog%2F","Cookie":"JSESSIONID=53192C23E69C63D3C51B36E759C13DC1; _pcid_=d397a8bb9eca4f0782103f9a27d6139e; Hm_lvt_67f90644532efbe0383b928e0af775fa=1465984181; QCOOKIE=323431383632373138302c323431383638333134342c; __utma=15969214.1934399813.1467100157.1467103120.1469852869.3; __utmz=15969214.1467100157.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); csrftoken=2IOphx0cuqfmxZVzujUbNCxokbR9veRA; auth_token=f2f5bf820b1e822012bdef0681b260cc3454e1ca","Protocol":"HTTP/1.1","Method":"POST","hostame":"sn.xxxx.com","URL":"/teamlog/login","status":"200","ResponseBytes":"5165","clientIP":"172.19.100.133","clientPort":55406,"serverIP":"172.17.106.190","serverPort":8080}
{"timestamp":"11/09/16-16:03:45.662537","UA":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.87 Safari/537.36","X-Forwarded-For":"-","Referer":"http://sn.xxxx.com:8080/teamlog/worklog/","Cookie":"JSESSIONID=9376EF8E2A0FCF00C07A309BCC59827B; TeamLog=5c5eff95a1cc1d3514899209562e852e; _pcid_=d397a8bb9eca4f0782103f9a27d6139e; Hm_lvt_67f90644532efbe0383b928e0af775fa=1465984181; QCOOKIE=323431383632373138302c323431383638333134342c; __utma=15969214.1934399813.1467100157.1467103120.1469852869.3; __utmz=15969214.1467100157.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); csrftoken=2IOphx0cuqfmxZVzujUbNCxokbR9veRA; auth_token=f2f5bf820b1e822012bdef0681b260cc3454e1ca","Protocol":"HTTP/1.1","Method":"GET","hostame":"sn.xxxx.com","URL":"/teamlog/worklog/templates/BrowseLogItemView.jsp","status":"200","ResponseBytes":"1128","clientIP":"172.19.100.133","clientPort":54516,"serverIP":"172.17.106.190","serverPort":8080}
{"timestamp":"11/09/16-16:03:45.559272","UA":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.87 Safari/537.36","X-Forwarded-For":"-","Referer":"http://sn.xxxx.com:8080/teamlog/worklog/","Cookie":"JSESSIONID=9376EF8E2A0FCF00C07A309BCC59827B; TeamLog=5c5eff95a1cc1d3514899209562e852e; _pcid_=d397a8bb9eca4f0782103f9a27d6139e; Hm_lvt_67f90644532efbe0383b928e0af775fa=1465984181; QCOOKIE=323431383632373138302c323431383638333134342c; __utma=15969214.1934399813.1467100157.1467103120.1469852869.3; __utmz=15969214.1467100157.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); csrftoken=2IOphx0cuqfmxZVzujUbNCxokbR9veRA; auth_token=f2f5bf820b1e822012bdef0681b260cc3454e1ca","Protocol":"HTTP/1.1","Method":"GET","hostame":"sn.xxxx.com","URL":"/teamlog/res/imgs/default-avatar.png?t=539","status":"200","ResponseBytes":"4001","clientIP":"172.19.100.133","clientPort":54515,"serverIP":"172.17.106.190","serverPort":8080}
{"timestamp":"11/09/16-16:03:45.664139","UA":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.87 Safari/537.36","X-Forwarded-For":"-","Referer":"http://sn.xxxx.com:8080/teamlog/worklog/","Cookie":"JSESSIONID=9376EF8E2A0FCF00C07A309BCC59827B; TeamLog=5c5eff95a1cc1d3514899209562e852e; _pcid_=d397a8bb9eca4f0782103f9a27d6139e; Hm_lvt_67f90644532efbe0383b928e0af775fa=1465984181; QCOOKIE=323431383632373138302c323431383638333134342c; __utma=15969214.1934399813.1467100157.1467103120.1469852869.3; __utmz=15969214.1467100157.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); csrftoken=2IOphx0cuqfmxZVzujUbNCxokbR9veRA; auth_token=f2f5bf820b1e822012bdef0681b260cc3454e1ca","Protocol":"HTTP/1.1","Method":"GET","hostame":"sn.xxxx.com","URL":"/teamlog/worklog/templates/BrowseLogCommentView.jsp","status":"200","ResponseBytes":"570","clientIP":"172.19.100.133","clientPort":54517,"serverIP":"172.17.106.190","serverPort":8080}
{"timestamp":"11/09/16-16:03:45.666645","UA":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.87 Safari/537.36","X-Forwarded-For":"-","Referer":"http://sn.xxxx.com:8080/teamlog/worklog/","Cookie":"JSESSIONID=9376EF8E2A0FCF00C07A309BCC59827B; TeamLog=5c5eff95a1cc1d3514899209562e852e; _pcid_=d397a8bb9eca4f0782103f9a27d6139e; Hm_lvt_67f90644532efbe0383b928e0af775fa=1465984181; QCOOKIE=323431383632373138302c323431383638333134342c; __utma=15969214.1934399813.1467100157.1467103120.1469852869.3; __utmz=15969214.1467100157.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); csrftoken=2IOphx0cuqfmxZVzujUbNCxokbR9veRA; auth_token=f2f5bf820b1e822012bdef0681b260cc3454e1ca","Protocol":"HTTP/1.1","Method":"GET","hostame":"sn.xxxx.com","URL":"/teamlog/worklog/templates/EditLogPeopleView.jsp","status":"200","ResponseBytes":"867","clientIP":"172.19.100.133","clientPort":54519,"serverIP":"172.17.106.190","serverPort":8080}
{"timestamp":"11/09/16-16:03:45.654500","UA":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.87 Safari/537.36","X-Forwarded-For":"-","Referer":"http://sn.xxxx.com:8080/teamlog/worklog/","Cookie":"JSESSIONID=9376EF8E2A0FCF00C07A309BCC59827B; TeamLog=5c5eff95a1cc1d3514899209562e852e; _pcid_=d397a8bb9eca4f0782103f9a27d6139e; Hm_lvt_67f90644532efbe0383b928e0af775fa=1465984181; QCOOKIE=323431383632373138302c323431383638333134342c; __utma=15969214.1934399813.1467100157.1467103120.1469852869.3; __utmz=15969214.1467100157.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); csrftoken=2IOphx0cuqfmxZVzujUbNCxokbR9veRA; auth_token=f2f5bf820b1e822012bdef0681b260cc3454e1ca","Protocol":"HTTP/1.1","Method":"GET","hostame":"sn.xxxx.com","URL":"/teamlog/worklog/templates/BrowseLogHeaderView.jsp","status":"200","ResponseBytes":"1024","clientIP":"172.19.100.133","clientPort":54515,"serverIP":"172.17.106.190","serverPort":8080}
{"timestamp":"11/09/16-16:03:45.664082","UA":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.87 Safari/537.36","X-Forwarded-For":"-","Referer":"http://sn.xxxx.com:8080/teamlog/worklog/","Cookie":"JSESSIONID=9376EF8E2A0FCF00C07A309BCC59827B; TeamLog=5c5eff95a1cc1d3514899209562e852e; _pcid_=d397a8bb9eca4f0782103f9a27d6139e; Hm_lvt_67f90644532efbe0383b928e0af775fa=1465984181; QCOOKIE=323431383632373138302c323431383638333134342c; __utma=15969214.1934399813.1467100157.1467103120.1469852869.3; __utmz=15969214.1467100157.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); csrftoken=2IOphx0cuqfmxZVzujUbNCxokbR9veRA; auth_token=f2f5bf820b1e822012bdef0681b260cc3454e1ca","Protocol":"HTTP/1.1","Method":"GET","hostame":"sn.xxxx.com","URL":"/teamlog/worklog/templates/BrowseLogPostCommentView.jsp","status":"-","ResponseBytes":"0","clientIP":"172.19.100.133","clientPort":54515,"serverIP":"172.17.106.190","serverPort":8080}
{"timestamp":"11/09/16-16:03:45.956380","UA":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.87 Safari/537.36","X-Forwarded-For":"-","Referer":"http://sn.xxxx.com:8080/teamlog/worklog/","Cookie":"JSESSIONID=9376EF8E2A0FCF00C07A309BCC59827B; TeamLog=5c5eff95a1cc1d3514899209562e852e; _pcid_=d397a8bb9eca4f0782103f9a27d6139e; Hm_lvt_67f90644532efbe0383b928e0af775fa=1465984181; QCOOKIE=323431383632373138302c323431383638333134342c; __utma=15969214.1934399813.1467100157.1467103120.1469852869.3; __utmz=15969214.1467100157.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); csrftoken=2IOphx0cuqfmxZVzujUbNCxokbR9veRA; auth_token=f2f5bf820b1e822012bdef0681b260cc3454e1ca","Protocol":"HTTP/1.1","Method":"GET","hostame":"sn.xxxx.com","URL":"/teamlog/worklog-data/getTags/","status":"200","ResponseBytes":"247","clientIP":"172.19.100.133","clientPort":54519,"serverIP":"172.17.106.190","serverPort":8080}
{"timestamp":"11/09/16-16:03:45.666677","UA":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.87 Safari/537.36","X-Forwarded-For":"-","Referer":"http://sn.xxxx.com:8080/teamlog/worklog/","Cookie":"JSESSIONID=9376EF8E2A0FCF00C07A309BCC59827B; TeamLog=5c5eff95a1cc1d3514899209562e852e; _pcid_=d397a8bb9eca4f0782103f9a27d6139e; Hm_lvt_67f90644532efbe0383b928e0af775fa=1465984181; QCOOKIE=323431383632373138302c323431383638333134342c; __utma=15969214.1934399813.1467100157.1467103120.1469852869.3; __utmz=15969214.1467100157.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); csrftoken=2IOphx0cuqfmxZVzujUbNCxokbR9veRA; auth_token=f2f5bf820b1e822012bdef0681b260cc3454e1ca","Protocol":"HTTP/1.1","Method":"GET","hostame":"sn.xxxx.com","URL":"/teamlog/worklog/templates/EditLogView.jsp","status":"200","ResponseBytes":"1280","clientIP":"172.19.100.133","clientPort":54518,"serverIP":"172.17.106.190","serverPort":8080}
{"timestamp":"11/09/16-16:03:45.954246","UA":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.87 Safari/537.36","X-Forwarded-For":"-","Referer":"http://sn.xxxx.com:8080/teamlog/worklog/","Cookie":"JSESSIONID=9376EF8E2A0FCF00C07A309BCC59827B; TeamLog=5c5eff95a1cc1d3514899209562e852e; _pcid_=d397a8bb9eca4f0782103f9a27d6139e; Hm_lvt_67f90644532efbe0383b928e0af775fa=1465984181; QCOOKIE=323431383632373138302c323431383638333134342c; __utma=15969214.1934399813.1467100157.1467103120.1469852869.3; __utmz=15969214.1467100157.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); csrftoken=2IOphx0cuqfmxZVzujUbNCxokbR9veRA; auth_token=f2f5bf820b1e822012bdef0681b260cc3454e1ca","Protocol":"HTTP/1.1","Method":"GET","hostame":"sn.xxxx.com","URL":"/teamlog/worklog-data/showSharedPeople/","status":"-","ResponseBytes":"0","clientIP":"172.19.100.133","clientPort":54515,"serverIP":"172.17.106.190","serverPort":8080}
{"timestamp":"11/09/16-16:03:45.964995","UA":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.87 Safari/537.36","X-Forwarded-For":"-","Referer":"http://sn.xxxx.com:8080/teamlog/worklog/","Cookie":"JSESSIONID=9376EF8E2A0FCF00C07A309BCC59827B; TeamLog=5c5eff95a1cc1d3514899209562e852e; _pcid_=d397a8bb9eca4f0782103f9a27d6139e; Hm_lvt_67f90644532efbe0383b928e0af775fa=1465984181; QCOOKIE=323431383632373138302c323431383638333134342c; __utma=15969214.1934399813.1467100157.1467103120.1469852869.3; __utmz=15969214.1467100157.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); csrftoken=2IOphx0cuqfmxZVzujUbNCxokbR9veRA; auth_token=f2f5bf820b1e822012bdef0681b260cc3454e1ca","Protocol":"HTTP/1.1","Method":"GET","hostame":"sn.xxxx.com","URL":"/teamlog/worklog-data/showSharedPeople/","status":"-","ResponseBytes":"0","clientIP":"172.19.100.133","clientPort":54515,"serverIP":"172.17.106.190","serverPort":8080}
{"timestamp":"11/09/16-16:03:45.968752","UA":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.87 Safari/537.36","X-Forwarded-For":"-","Referer":"http://sn.xxxx.com:8080/teamlog/worklog/","Cookie":"JSESSIONID=9376EF8E2A0FCF00C07A309BCC59827B; TeamLog=5c5eff95a1cc1d3514899209562e852e; _pcid_=d397a8bb9eca4f0782103f9a27d6139e; Hm_lvt_67f90644532efbe0383b928e0af775fa=1465984181; QCOOKIE=323431383632373138302c323431383638333134342c; __utma=15969214.1934399813.1467100157.1467103120.1469852869.3; __utmz=15969214.1467100157.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); csrftoken=2IOphx0cuqfmxZVzujUbNCxokbR9veRA; auth_token=f2f5bf820b1e822012bdef0681b260cc3454e1ca","Protocol":"HTTP/1.1","Method":"GET","hostame":"sn.xxxx.com","URL":"/teamlog/worklog-data/showWorkLogData?period=2016-11-06%2C2016-11-13&people=1","status":"200","ResponseBytes":"2674","clientIP":"172.19.100.133","clientPort":54518,"serverIP":"172.17.106.190","serverPort":8080}

the pcap is in [词典] attachment

Files

Download all files
qq.com.pcap (57.4 KB) qq.com.pcap wilson green, 11/09/2016 03:03 AM
suricata.3.1.3 online.yaml (68.6 KB) suricata.3.1.3 online.yaml all the cofig wilson green, 11/10/2016 08:58 PM
suricata.yaml (62.5 KB) suricata.yaml The right config wilson green, 11/10/2016 09:10 PM
qq.com.54515-8080.pcap (13.9 KB) qq.com.54515-8080.pcap pcap with flow where logging fails in multi thread Paulo Pacheco, 12/04/2016 07:39 AM
1946.patch (879 Bytes) 1946.patch Paulo Pacheco, 12/04/2016 01:10 PM
Actions
Copy link

Also available in: Atom PDF