3.5.11 http_client_body

The http_client_body keyword is a content modifier that restricts the search to the body of an HTTP client request.

As this keyword is a modifier to the previous content keyword, there must be a content in the rule before 'http_client_body' is specified.

The amount of data that is inspected with this option depends on the post_depth config option of HttpInspect. Pattern matches with this keyword wont work when post_depth is set to -1.

3.5.11.1 Format

verbatim620#

3.5.11.2 Examples

This rule constrains the search for the pattern ;SPMquot;EFG;SPMquot; to the raw body of an HTTP client request.

verbatim621#

rawhtml155# The http_client_body modifier is not allowed to be used with the rawbytes modifier for the same content. rawhtml156#