<![CDATA[How to suppress INVALID CONTENT-LENGTH OR CHUNK SIZE]]>I am constantly getting these in Snort Alerts.  Is it ok to suppress these for my ISP's address?  What is the code to supress this kind of http_inspect?

WAN Jul 09 06:45:39 my.isp.my.isp:8644    (http_inspect) INVALID CONTENT-LENGTH OR CHUNK SIZE
                                      62.119.66.46:80

I think that it should be something like:
suppress gen_id 120, sig_id 2, track by_src, ip my.isp.my.isp

Thanks

]]>https://forum.netgate.com/topic/102627/how-to-suppress-invalid-content-length-or-chunk-sizeRSS for NodeMon, 16 Mar 2026 02:50:22 GMTSun, 10 Jul 2016 14:32:29 GMT60<![CDATA[Reply to How to suppress INVALID CONTENT-LENGTH OR CHUNK SIZE on Mon, 11 Jul 2016 14:29:35 GMT]]>@battles:

Thanks.  I was trying to individually suppress a rule for my isp address in Services / Snort / Alerts, and upon clicking the + button, I got this error:

The following input errors were detected:
Suppress List 'wansuppress_57828044c1f52' is defined for this interface, but it could not be found!

Wonder what this is about?

Maybe a previously created/assigned suppress list that was later deleted.  Go to the INTERFACE SETTINGS tab for the Snort interface and set the SUPPRESS LIST to "default" and save the change.  Now go back to the ALERTS tab and try the suppress action again.  When you click the suppress icon on the ALERTS tab, it will auto-create a Suppress List file for the interface and assign it if one does not already exist.  If one is defined in the config.xml, then it will use that one instead.  In your case, one was defined in the config.xml for the interface but the actual content was not in the config.xml file.  This usually means the old list was deleted.

Bill

]]>https://forum.netgate.com/post/636854https://forum.netgate.com/post/636854Mon, 11 Jul 2016 14:29:35 GMT<![CDATA[Reply to How to suppress INVALID CONTENT-LENGTH OR CHUNK SIZE on Mon, 11 Jul 2016 14:17:32 GMT]]>Thanks.  I was trying to individually suppress a rule for my isp address in Services / Snort / Alerts, and upon clicking the + button, I got this error:

The following input errors were detected:
Suppress List 'wansuppress_57828044c1f52' is defined for this interface, but it could not be found!

Wonder what this is about?

]]>https://forum.netgate.com/post/636846https://forum.netgate.com/post/636846Mon, 11 Jul 2016 14:17:32 GMT<![CDATA[Reply to How to suppress INVALID CONTENT-LENGTH OR CHUNK SIZE on Mon, 11 Jul 2016 00:28:12 GMT]]>@battles:

Finally figured this out: Service / Snort / Alerts / click + next to rule to suppress.

Yuo got it.  You can also just completely disable that rule.  I think a lot of folks disable quite a number of the HTTP_INSEPCT preprocessor rules as they tend to alert on just about every tiny infraction of RFC specs.  To disable a rule on the ALERTS tab, click the red X icon located beside the GID:SID.

Bill

]]>https://forum.netgate.com/post/636759https://forum.netgate.com/post/636759Mon, 11 Jul 2016 00:28:12 GMT<![CDATA[Reply to How to suppress INVALID CONTENT-LENGTH OR CHUNK SIZE on Sun, 10 Jul 2016 17:04:23 GMT]]>Finally figured this out: Service / Snort / Alerts / click + next to rule to suppress.

]]>https://forum.netgate.com/post/636725https://forum.netgate.com/post/636725Sun, 10 Jul 2016 17:04:23 GMT