ASM - file type length on certain urls

Sorry if this response might sound total "rookie" lol, but are you using dynamic file sizes?

 

 

I'm assuming you are. I think it's going to be hard to filter on the file size. I mean if you have a dynamic file size and your worried about the content of the file being malicious you're really going to have to look at the file and not the size in an environment with dynamic events. And here lies the boundry from known to APT right?

 

 

Maybe there's an iRule that can be create. What I mean by this is you can compare the file size from previous to current and justify an amount of change?

 

 

If your starting out with a blank form, and then there's something that's going to be filled in...well there's only so much that can be entered into a form (i.e. name, address, phone number etc.)

 

 

So, i'm not too sure if it's the size that matters? lol =)

 

but, more like: who, what, where, when of the file and then go from there. I mean you might be able to do specific form flows for certain files. that would be one way to completely negate the need for size checking since your tightening the traffic to a known path.

 

 

cheers!