topic Blocking file downloads based on content disposition in General Topics

Blocking file downloads based on content disposition

HITSSEC — Wed, 11 Dec 2013 02:41:57 GMT

Hello,

We are trying to block specific files based on the content disposition. Using all the different context values for http traffic has proven ineffective. The issue is that we don't see the file name until the end of the file download. A screen shot of the packet capture is shown. Support has not been successful at providing me how to identify the file name so I can block it.

We current create custom signatures and are familiar with the PA reference document. Any ideas would be helpful.

Phil

Re: Blocking file downloads based on content disposition

JimS2 — Sat, 14 Dec 2013 16:34:41 GMT

Please post this question in the Dev center. You are much more likely to get an answer there as that is the official support location for customer signatures.

Re: Blocking file downloads based on content disposition

HITSSEC — Mon, 16 Dec 2013 02:50:12 GMT

Moved question to Development Center - Thanks