Inflate Session Agent

The Inflate session agent performs multiple pipeline functions, including the expansion of data compressed by a Web server for HTTP transfer. By default, this session agent is always configured as part of every pipeline.

Note: For some deployments of the Processing Server, this session agent is included in the default pipeline and is required.
Note: If you are capturing IP addresses in IPv6 format, to enable indexing and searching for these addresses, you must do one of the following:
  • Upgrade to the latest DNCA Build
  • Deploy the Inflate session agent in each Windows™ processing pipeline.
Note: This session agent should appear before any session agent that may examine the data in the HTTP Response, including Privacy, DataParser, and RTA.

Overview

Since this session agent is typically present and placed before any of the processing session agents, Inflate session agent has been augmented with additional functionality for performance and pipeline simplicity. It can also perform the following functions:

  • Unreqcancelled - This functionality can be used to identify false positives in which a request appears to have been cancelled by the visitor. Typically, this functionality can be managed by the Network Capture Device, but it can be a burden on the CPU. When enabled through the Inflate session agent, this options allows for the offloading of this functionality, as the Inflate session agent is already working with the Response buffer.
  • Internationalization - To manage localization issues, the Network Capture Device can insert some buffer variables into the request related to internationalization. If these variables are not present, the Inflate session agent adds them. This feature requires no configuration.
  • Deflate - Optionally, the Inflate session agent can be configured to deflate (compress) the HTTP response data, which is useful in pipelines that are configured to forward captured hits across the network to other servers.
    • The Inflate session agent replaces the Compress session agent, which has been deprecated.
  • IPv6 Request Data - To support the indexing and searching for IPv6 addresses, the Inflate session agent inserts some request variables for IP addresses in IPv6-compatible format.
Note: This session agent must be used if compressed data is processed by session agents other than the terminating session agents (Archive, Socket, or Null) or by the Discover Session Index Program.

Adding the Session Agent

Session agents can be added through the Pipeline Editor in Manage Services. See "Adding Session Agents" in Unica Discover Administration Manual.

  • For more information on the Pipeline Editor and Manage Services, see "Discover Management System" in the Unica Discover Administration Manual.

The remainder of this page describes configuration options and how to change them through the DiscoverCaptureSocket.cfg file stored on the server. These settings are also available through the Pipeline Editor, which is the recommended method for configuring session agents.

Configuration Settings

The following settings are available for the Inflate session agent.

  • Display Name values are displayed in Manage Services, which is the recommended method for configuring session agents. See "Discover Management System" in the Unica Discover Administration Manual.
  • Name values are displayed in DiscoverCaptureSocket.cfg.
Table 1. Inflate Session Agent
Display Name Name Description
Replace Response On Error ReplaceResponseOnError When set to True, an error encountered while decompressing a response that has a Content-Encoding of gzip or deflate causes the response body to be replaced with valid HTML containing a descriptive error message.
  • The default value is True.
  • When set to False, the original response is retained when an error occurs during decompression.
    Note: When this value is set to False and the decompression operation fails, the following message is inserted into the request: InflateFailed=True.
UnReqCancelled UnReqCancelled Request Cancelled hits occur when the Unica Discover Network Capture Application server cannot complete the capture. Typical reasons for a hit being Request Cancelled is if the DNCA server did not receive a web server response for the browser request or if the size of the web server response did not match the size specification in the response header. In some cases, a mismatch in the response size does not indicate an incomplete response. For example, an HTML response contained a trailing </html> tag or a proper XML close tag may still be a complete response. When this setting is set to True (the default value), ReqCancelled hits examine the response for a proper closing tag. If one is found, the session agent changes the ReqCancelled value to False.
Max Inflate Size MaxInflateSize This setting specifies the maximum response size to which this session agent inflates a deflated or compressed response. This setting is a pipeline safety limit to prevent inflation of very large responses. The default value is 1536 KB.
Default Encoding DefaultEncoding When Mode is set to deflate, this value indicates the default encoding scheme to apply to the decompressed text. The default value is iso-8859-1.
Compression Level CompressionLevel When Mode is set to deflate, this value indicates the level of compression to use when compressing. Compression levels range from 1 (least) to 9 (most). The default value is 5.
Mode Mode This setting defines the operating mode of the session agent.
  • Inflate - Inflate session agent decompresses HTTP response data.
  • Deflate - Inflate session agent compresses HTTP response data. If neither value is explicitly specified, the session agent operates in Inflate mode.

IPv6 Request Data

Beginning in Build 3501, the Unica Discover Network Capture Application supports the capture of IP addresses in IPv4 and IPv6 format. Depending on the detected format, IP addresses are written into an IPv6-compatible format into the following request variables:

  • IPV6_REMOTE_ADDR
  • IPV6_LOCAL_ADDR

If these variables are not present in the request, the Inflate session agent automatically inserts them.

These request variables are then indexed for search purposes, enabling the searching for IPv4 or IPv6 addresses through a single search field.