A security team at an online retailer keeps watching their HTTP intrusion rules miss obvious command-and-control URLs even though packet captures show the exact request on the wire, split across overlapping TCP segments with mixed-case headers. Which network analysis setting in Secure Firewall Threat Defense should they tune so the request reaches inspection in a consistent form?
Select an answer to reveal the explanation.
Short Explanation
You’ll want to tune TCP reassembly and HTTP normalization in your network analysis policy so the request is rebuilt consistently before inspection. Think of it as piecing together a scrambled message before checking what it says; normalization reduces variations so you don’t need a separate rule for each one.
Full Explanation
Tune TCP reassembly and HTTP normalization in the network analysis policy. Reassembly reconstructs the byte stream from overlapping TCP segments before intrusion inspection, while HTTP normalization presents the request in a consistent form, including handling mixed-case headers. Together, these settings address both segmentation and application-level variations that can prevent a rule from matching. Enabling TCP reassembly with the endpoint’s overlap policy but leaving HTTP normalization disabled rebuilds the stream, yet mixed-case headers may still reach inspection in an unexpected form. Enabling HTTP normalization while inspecting packets individually does not rebuild the overlapping segments, so inspection may not see the complete request as the endpoint interprets it. Enabling both functions with an overlap policy that conflicts with the endpoint’s first-segment-wins behavior can cause the firewall to reconstruct a different stream from the one the server receives, making detection unreliable. Exam caveat: reassembly and normalization are distinct controls, and overlap handling should match the protected host’s behavior. Practical check: validate the policy with a representative capture containing overlapping segments and mixed-case headers, then confirm the reconstructed request and intrusion event agree with what the endpoint processed.