urilen:min<>max[,<uribuf>]; urilen:[<|>]<number>[,<uribuf>]; <uribuf> : "norm" | "raw"
The following example will match URIs that are 5 bytes long:
urilen:5;
The following example will match URIs that are shorter than 5 bytes:
urilen:<5;
The following example will match URIs that are greater than 5 bytes and less than 10 bytes:
urilen:5<>10;
The following example will match URIs that are greater than 500 bytes using the normalized URI buffer:
urilen:>500,norm;
The following example will match URIs that are greater than 500 bytes explicitly stating to use the raw URI buffer:
urilen:>500,raw;
This option works in conjunction with the HTTP Inspect preprocessor specified in Section 2.2.6.