HI all,
What does “SURICATA HTTP Request abnormal Content-Encoding header” mean exactly? Is it something to do with the web server using compression? Seem to get a lot of them.
thanks
Darrin
yes that can be related to the gzip compression or deflate. Would be worth to check in a pcap if it’s really the case or a new legit way that Suricata does not recognize properly.