Definition
Canonical reference for request_size behavior.
Catalog code
request_size
Display name
Request size anomaly
How to read this signal
This annotator represents a behavioral pattern, not a claim of identity.
It’s designed to help you understand why certain traffic looks suspicious, automated,
probing, or exploit-oriented — and to support consistent reporting across the Syndu system.
Explanation
Flags abnormal request sizes such as unusually large query strings, oversized headers, or repeated large payload attempts. This can indicate fuzzing, stress attempts, malformed clients, or automation. False positives can occur (large cookies, tracking parameters, legitimate API usage), so interpret with endpoint context and recurrence.
