Non-HTTP Traffic Tunneled over Port 80

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•1

This rule detects non-HTTP traffic being tunneled over TCP port 80. It specifically looks for established TCP connections to port 80 where the application layer protocol is not identified as HTTP and the data payload size is greater than 100 bytes. A threshold is applied to trigger an alert if 10 such events occur from the same source IP within 60 seconds. This behavior is often indicative of command and control (C2) communication or data exfiltration attempting to blend in with legitimate web traffic.