From c621da523b29fe8419391fbf1d6a5b51ea211c34 Mon Sep 17 00:00:00 2001 From: Seth Hall Date: Wed, 28 Sep 2011 11:18:24 -0400 Subject: [PATCH] Since these now measure "seen" data, set the default to 0. - A null value no longer fits since if there is no body a value of zero makes sense. Previously, a null value would makes sense because the Content-Length header may not have been sent which would leave the field null. --- scripts/base/protocols/http/main.bro | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/base/protocols/http/main.bro b/scripts/base/protocols/http/main.bro index efaa2e12c9..3bfd302ab5 100644 --- a/scripts/base/protocols/http/main.bro +++ b/scripts/base/protocols/http/main.bro @@ -32,13 +32,13 @@ export { user_agent: string &log &optional; ## The actual uncompressed content size of the data transferred from ## the client. - request_body_len: count &log &optional; + request_body_len: count &log &default=0; ## This indicates whether or not there was an interruption while the ## request body was being sent. request_body_interrupted: bool &log &default=F; ## The actual uncompressed content size of the data transferred from ## the server. - response_body_len: count &log &optional; + response_body_len: count &log &default=0; ## This indicates whether or not there was an interruption while the ## request body was being sent. An interruption could cause hash ## calculation to fail and a number of other problems since the