Post by: pooms on June 24, 2002, 06:27:44 PM
recently noticed an HTTP POST that was triggered at the end of a video
clip embedded in an HTML page. This POST contained an HTTP header starting
with
Pragma: log-line=followed by a whole bunch of stuff.
Included in it was the IP address of my computer, as well as the name of
my computer.
Unfortunately I haven't been able to cause this POST to happen again, so I don't
know what it was that triggered it. And in my trying to recreate it, I
forgot to copy and save the header line from the Log Window.
So I'm not certain if it was "log-line" or "log_line".
I haven't found anything on the net that provides any clue about this
header. For now I've put in a header filter that looks for any occurrence
of my computer name in a Pragma header and calls $ALERT. Hopefully I'll
be able to catch this again and figure out what is going on.
Post by: sidki3003 on June 24, 2002, 06:40:56 PM
I was reading Jor's post about Windows Media Player:
http://asp.flaaten.dk/pforum/topic.asp?ARCHIVE=&TOPIC_ID=179
Now i'm thinking about a filter that alerts on every outgoing Pragma,
that's *not* "no-cache".
sidki
Post by: TEggHead on June 24, 2002, 06:53:56 PM
Edited by - TEggHead on 24 Jun 2002 20:40:41
Post by: sidki3003 on June 24, 2002, 07:27:45 PM
This one keeps Media player from working, but one can at least see what's happening.
[HTTP headers]
In = FALSE
Out = TRUE
Key = "Pragma: Block except no-cache (DEBUG) (Out)"
Match = "(^no-cache) &$ALERT(Suspicious outgoing Pragma: )"
Post by: pooms on June 24, 2002, 07:45:42 PM
quote:
is the option "Allow Internet sites to uniquelly identify your Player" checked by any chance?
No, I unselected that some time ago
and I played around with itlooking at what difference it made to the HTTP Headers. It still sent
the Pragma: xClientGUID, as Jor mentioned, but it sent a different GUID value after
you uncheck that box. I could only guess that it was sending a "generic"
GUID in that case. I suppose we could compare GUID's to see if that is the
case.
Post by: sidki3003 on June 24, 2002, 08:02:12 PM
Pragma: log-line=0.0.0.0 2002-06-24 18:39:12 - ...
isn't needed. I just tried this mod of Jor's filter.
In = FALSE
Out = TRUE
Key = "Pragma: Block WiMp Reporting (Out)"
Match = "(xClientGUID|log-line)="
Post by: pooms on June 24, 2002, 11:13:34 PM
The times that I've seen it, it almost looked like the POST call wasn't
supposed to happen. There was no data in the POST, and the URL for it
was the same as the URL for the video, and the server responded with an
error. But what worried me was that this might be some sort of built-in
thing about media player that other sites could be using, even if the
one I saw didn't seem to be configured to use it.
BTW, I'm using v 6.4 of media player.
Post by: pooms on June 25, 2002, 06:25:41 PM
the Pragma : log-line. Although I had configured the media player to
use a proxy for HTTP, I was also allowing it to use all possible protocols
in addition to HTTP. So I guess sometimes it would use HTTP and I would
see it in Proxomitron's Log Window, and other times it would not use
HTTP and I wouldn't see what was happening.
Post by: sidki3003 on June 25, 2002, 06:35:13 PM
you are always asked when it doesn't connect via Proxomitron.
BTW, that's how i do it with IE as well.
edit: I noticed once that when i denied WMP's direct connect, it then used HTTP via prox
.Edited by - sidki3003 on 25 Jun 2002 19:49:54
Post by: Jor on July 18, 2002, 11:25:57 AM
Take a look at this filter:
In = FALSE
Out = TRUE
Key = "Pragma: Block WiMP GUID Reporting (Out)"
Match = "(xClientGUID|log-line)1= $ALERT(WiMP 1: was sent to u !)"
Think it covers all the bases now.
XPost'd in my old thread.