"Server responded with 0 code" returned from dlptest.com

Products

• Data Loss Prevention Endpoint Prevent
• Data Loss Prevention Endpoint Suite
• Data Loss Prevention

Issue/Introduction

When performing policy tests by uploading documents to dlptest.com, a Data Loss Prevention (DLP) block popup message may appear as intended. However, in some instances, the website returns a "Server responded with 0 code" error. 

Environment

Symantec Data Loss Prevention Endpoint Agent

Cause

The "Server responded with 0 code" message is generated by the third-party website, not by the DLP Agent. The server returns this code instead of a typical HTTP 500 error because it did not receive the expected file upload due to the DLP response rule blocking the transmission.

The Endpoint Agent edpa_ext0.log (deobfuscated) shows: 

05/28/2024 16:09:09 | 5224 | INFO | CoreServices.MessageLogger | MESSAGETYPE_DETECTION_REQUEST MESSAGESOURCE_FILE_SYSTEM_CONNECTOR 05/28/2024 14:09:09 [
Request Id #103943
Detection Request Details :
 Session Command : Single Request
 Request Type : Data In Motion Request

Dim Detection Request Details :
 Process Id : 788
 Process Path : C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
 Application Name : Microsoft Edge

 User : #####
 Domain :#####
 Time Stamp : 05/28/2024 14:09:09
 Dim Event Type : HTTP(S)


HTTP(S) Details :
 URL : https://dlptest.com/https-post/

Network Info Details :
 Source IP :
 Source Port : 0
 Source Domain :
 Destination IP :
 Destination Port : 0
 Destination Host Name : dlptest.com

File Attachment Details :
 File Path : <path>\<File_name_being_uploaded>
]
05/28/2024 16:09:09 | 5224 | INFO | CoreServices.MessageLogger | MESSAGETYPE_DETECTION_RESPONSE MESSAGESOURCE_DETECTION_CACHE 05/28/2024 14:09:09 [
Request Id #103943 SUCCESS prevent
Scan Time : 0 ms]

 

The "Request Id #103943 SUCCESS prevent" indicates the file was prevented (i.e. blocked) from being uploaded.

If the file was not blocked, it would show: "Request Id #xxxxxxx SUCCESS allow"

 

Resolution

The "Server responded with 0 code" message is generated by the website itself. It's not a DLP generated message. 

The server responded with 0 code instead of giving the typical HTTP 500 error when the server didn't receive the expected file upload as the DLP response rule blocked the file send. 

 

Additional Information

Broadcom has no affiliation with the https://dlptest.com/ website. It is not owned by Broadcom.
If you encounter problems with the site or require further information please contact the site owner.