Data Loss Prevention Web Prevent reject ICAP header superior than 8192 Bytes

Products

• Data Loss Prevention Network Prevent for Web

Issue/Introduction

Traffic received from Web Proxy to Data Loss Prevention ICAP Web Prevent Server is discarded when it has more than 8192 Bytes in the header.

Examples of errors

---

ICAP/1.0 400 Bad request

Connection: close

Connection was aborted.

----

FileReader log detail:

Dec 12, 2016 2:56:29 AM com.vontu.icap.SocketCommunicator readLine
WARNING: Reached buffer size in readline(). Buffer content: [Content removed from here is an ASCII rendering of an X-Authentication stream ...]

Dec 12, 2016 2:56:29 AM com.vontu.icap.RequestProcessor sendIcapErrorFromInductorException
WARNING: On ICAP connection ID=28017 bad request error sent.

Resolution

In Enforce -> System -> Servers and Detectors. Select the Network Prevent for Web -> Server Settings.

Increase SocketCommunication.BufferSize from 8K to a greater value. It has been reported in few occasions that increasing the value to 20k is resolving the issue.