INVALID CHUNK SIZE OR WRONG CHUNK from vip.ext-worldapi-phx.agni.lindenlab.com

[Chroma Starlight]

What caused vip.ext-worldapi-phx.agni.lindenlab.com to non-routinely send packets that freak out IDS?

[Fritigern Gothly]

1 hour ago, Chroma Starlight said:

What caused vip.ext-worldapi-phx.agni.lindenlab.com to non-routinely send packets that freak out IDS?

I see a paranoid firewall.

[Wulfie Reanimator]

2 hours ago, Fritigern Gothly said:

I see a paranoid firewall.

Or a bug.

[animats]

That's an HTTP error detected by the firewall. That's some auxiliary query something is making of an SL server. Probably not the 3D world, but something like search, or groups, or some other 2D interface thing. Can you find out what you were doing when it happened?

The error seems to be associated with HTTP chunked transfer encoding, an obscure feature of HTTP. That's not used much, and it would not be surprising if something in the viewer or server didn't conform to the spec, or the intrusion detection misinterpreted it, or some broken middlebox messed it up.

Somebody who is really into Wireshark could track this down, if you can make it happen reproduceably. If you can get a reproduceable error, file a JIRA.

[Monty Linden]

@Chroma StarlightIf you can get your IDS to provide more info about the bad chunk or trailing data, I'd be very interested in seeing it.

[Chroma Starlight]

4 hours ago, Monty Linden said:

@Chroma StarlightIf you can get your IDS to provide more info about the bad chunk or trailing data, I'd be very interested in seeing it.

I'll be back with a tcpdump-style packet capture of the offending traffic the next time it occurs and pass it along to you.

Edited August 20, 2020 by Chroma Starlight

[Monty Linden]

Love pcaps.  Just be careful with their distribution - they're full of secrets.