For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

igorzhuk's avatar
igorzhuk
Icon for Altostratus rankAltostratus
Aug 07, 2018

Capturing specific HTTP Request and Response

Hi I have a Capturing specific HTTP Request and Response Headers How i can Capturing only response for the request?

when CLIENT_ACCEPTED {
  set transfers_flag 0
  set secs [clock seconds]
  set msec [clock clicks -milliseconds]
  set secs1000 [expr { $secs * 1000 } ]
  set fract [expr { $msec - $secs1000 }]
  if { $fract >= 1000 } {
    set diff [expr { $fract / 1000 }]
    incr secs $diff
    incr fract [expr { -1000 * $diff }]
  }
  set tcp_start_time [clock format $secs -format {%H:%M:%S}].$fract
  set hsl [HSL::open -publisher /Common/syslog-publisher]
  set FrontEndIP "FrontEndIP: Client:[IP::client_addr]:[TCP::client_port]->[clientside {IP::local_addr}]:[clientside {TCP::local_port}]"
  set Session_info "$tcp_start_time | $FrontEndIP"
  set Transfers_headers $Session_info
}

when HTTP_REQUEST {
  set Http_Host_Uri "Http-Method-Host-Uri: [HTTP::method] [HTTP::host][HTTP::uri]" 
  if { ([HTTP::uri] starts_with "/MyAPP") && ([HTTP::uri] contains "iflock=3") } {
    set transfers_flag 1
    append Transfers_headers "  HTTP_REQ_transfersMyApp_headers >> "
    foreach aHeader [HTTP::header names] {
        append Transfers_headers "  Header_name:$aHeader Value:[HTTP::header value $aHeader] "
    }
    append Transfers_headers " endof HTTP_REQ_transfer headers "
  }
  append Session_info " >> $Http_Host_Uri"
  log local0. $tcp_start_time||$Http_Host_Uri
}

when HTTP_RESPONSE {
    if { $transfers_flag } {
        set Response_code [HTTP::status]
        append Transfers_headers "  Response_code: $Response_code  HTTP_RESP_transfersMyApp_headers >> "
        foreach aHeader [HTTP::header names] {
            append Transfers_headers "  Header_name:$aHeader Value:[HTTP::header value $aHeader] "
        }
        append Transfers_headers " endof HTTP_RESP transfer headers "
    }
}

when CLIENT_CLOSED {
    if { [info exists transfers_flag] && $transfers_flag } {
        log local0. transfers_flag_exists_$transfers_flag 
        HSL::send $hsl "<190> $Transfers_headers"
    }
}

1 Reply