HTTP: Small First Packet
This signature detects a very small first data packet during an HTTP session. This may be an indication of "Session Slicing" which is an IPS evasion technique. The HTTP specification defines the minimum request size to be 15 bytes.
Short Name
HTTP:EXPLOIT:SMALL-FIRST-DATA
Severity
Warning
Recommended
False
Recommended Action
Drop
Category
HTTP
Keywords
First Packet Small
Release Date
05/01/2008
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3324
False Positive
Rarely