Hit processing

Table 1. Hit processing settings
Setting	Description
`Include Raw Request`	Determines whether RawRequest is on. RawRequest is an aid in debugging. The default value is `False` (disabled). If enabled (`True`), the HTTP Request headers are added to the hit. Note: Discover highly recommends that this value can set to `False`; otherwise data is added to each hit.
`Include Response Headers`	Determines whether ResponseHeaders are on. ResponseHeaders are aids in debugging. The default value is `False` (disabled). If enabled (`True`), the HTTP Response headers (in Discover format, not necessarily the exact HTTP representation) are added to the hit. Note: Discover highly recommends that this value stay set to `False`; otherwise data is added to each hit.
`Decode URL fields`	This option determines whether to URL-decode URL fields.
`Cookie Parser`	If this option is selected, a cookies section is added to the request.
`Enable UnReq Cancelled`	If enabled, this option checks the last 100 bytes of the response body for `</html` when `capturetype=1` and marked as canceled.
`Inflate compressed response`	When this option is selected, responses are automatically inflated in the DNCA pipeline. If a response has a content-encoding header whose value is `deflate`, `gzip`, or `x-gzip`, then it is a candidate for having the body that is inflated from its compressed state. If this option is selected, then an attempt is made to inflate the response. Note: This setting must be set to `false`. Enabling this feature can significantly increase the data volume that is transmitted between the Unica Discover Network Capture Application server and the Transport Service. If the inflate fails, a message is logged at the `notice` log level. If the inflate succeeds, the value of the content-encoding header is overwritten with `X`'s; for example, Content-Encoding: `XXXX`. Compressed POSTs are automatically inflated for the content-encoding types, regardless of the content type, to support capture of data from Discover client frameworks.
`Preserve responses when inflate fails`	When a hit response is inflated and the inflate process fails, the response is replaced with HTML reporting that an inflate error is occurred. Select this option to disable the replacement HTML, which preserves the original response.
`Deflate hits sent to target recipients`	Select this option to deflate hit responses before they are sent to a target recipient. The hit responses are compressed by using the HTTP deflate method. Enable this option to reduce the amount of network bandwidth that is used to deliver Discover hits to the Discover Transport Service.
`Enable I18N`	When selected, internationalization support is enabled on the DNCA. The request urlfields are encoded to UTF-8, and an attempt is made to detect the response body encoding. Note: There is a known issue in which special characters submitted in JSON data from a Discover client framework are mangled.
`Delete Images on DNCA side`	When enabled, this option deletes image hits in the capture stream that meet specific criteria. See Delete Images on DNCA Side.
`Max Response Size`	The largest acceptable response size (in bytes). The default value is `1572864` (1.5 MB).
`Default Response Encoding`	If the DNCA is not able to detect the encoding type of a response, this value is used.
`Default Request Encoding`	If the DNCA is not able to detect the encoding type of a request, this value is used.
`Total dropped due to ICU encoding errors`	This statistic reports each time a hit (either Request or Response) cannot be encoded to UTF-8 which causes the complete hit to be dropped. This scenario also generates an error (ERR) in the log.

Include Raw Request

Determines whether RawRequest is on. RawRequest is an aid in debugging. The default value is False (disabled). If enabled (True), the HTTP Request headers are added to the hit.

Note: Discover highly recommends that this value can set to False; otherwise data is added to each hit.

Include Response Headers

Determines whether ResponseHeaders are on. ResponseHeaders are aids in debugging. The default value is False (disabled). If enabled (True), the HTTP Response headers (in Discover format, not necessarily the exact HTTP representation) are added to the hit.

Note: Discover highly recommends that this value stay set to False; otherwise data is added to each hit.

Decode URL fields

This option determines whether to URL-decode URL fields.

Cookie Parser

If this option is selected, a cookies section is added to the request.

Enable UnReq Cancelled

If enabled, this option checks the last 100 bytes of the response body for </html when capturetype=1 and marked as canceled.

Inflate compressed response

When this option is selected, responses are automatically inflated in the DNCA pipeline. If a response has a content-encoding header whose value is deflate, gzip, or x-gzip, then it is a candidate for having the body that is inflated from its compressed state. If this option is selected, then an attempt is made to inflate the response.

Note: This setting must be set to false. Enabling this feature can significantly increase the data volume that is transmitted between the Unica Discover Network Capture Application server and the Transport Service.

If the inflate fails, a message is logged at the notice log level.
If the inflate succeeds, the value of the content-encoding header is overwritten with X's; for example, Content-Encoding: XXXX.
Compressed POSTs are automatically inflated for the content-encoding types, regardless of the content type, to support capture of data from Discover client frameworks.

Preserve responses when inflate fails

When a hit response is inflated and the inflate process fails, the response is replaced with HTML reporting that an inflate error is occurred. Select this option to disable the replacement HTML, which preserves the original response.

Deflate hits sent to target recipients

Select this option to deflate hit responses before they are sent to a target recipient. The hit responses are compressed by using the HTTP deflate method. Enable this option to reduce the amount of network bandwidth that is used to deliver Discover hits to the Discover Transport Service.

Enable I18N

When selected, internationalization support is enabled on the DNCA. The request urlfields are encoded to UTF-8, and an attempt is made to detect the response body encoding.

Note: There is a known issue in which special characters submitted in JSON data from a Discover client framework are mangled.

Delete Images on DNCA side

When enabled, this option deletes image hits in the capture stream that meet specific criteria. See Delete Images on DNCA Side.

Max Response Size

The largest acceptable response size (in bytes). The default value is 1572864 (1.5 MB).

Default Response Encoding

If the DNCA is not able to detect the encoding type of a response, this value is used.

Default Request Encoding

If the DNCA is not able to detect the encoding type of a request, this value is used.

Total dropped due to ICU encoding errors

This statistic reports each time a hit (either Request or Response) cannot be encoded to UTF-8 which causes the complete hit to be dropped. This scenario also generates an error (ERR) in the log.