command to match head of HTTP

Are you referring to the bolded text?

 

 

If so, then:

 

 

[HTTP::header Referer]

 

Hi Robbie,

 

 

MiLK_Man is correct. You should be able to use that value to detect any Referer Value. For additional information take a look at the HTTP::header command.

 

 

Because the values in the field are not automatically broken down into normal iRule Commands (HTTP::host, HTTP::uri, HTTP::path, or HTTP::query), you will have to search the value as a string.

 

 

Examples:

 

Change Referer on inbound HTTP::header

 

Header replacement assistance

 

 

Hope this helps.

hi,

 

I want to match the uri after HEAD .not refer,it is in the first line

 

it is

 

"

 

HEAD /portal/jsp/getSavedSearch.do HTTP/1.1

 

User-Agent: Mozilla/4.5 [en] (X11; U; SunOS 5.6 sun4u)

 

Host: bpm.stubprod.com

 

Accept: */*

 

Referer: https://bpm.stubprod.com/portal/jsp/getSavedSearch.do

 

X-Forwarded-For: 10.80.65.145

 

"

 

in the wireshark,I can see request uri,but it can't be pasted

 

I want to math this request uri in HEAD method of http

 

e.g.

[root@ve10:Active] config  b virtual bar list
virtual bar {
   snat automap
   pool foo
   destination 172.28.19.79:80
   ip protocol 6
   rules myrule
   profiles {
      http {}
      tcp {}
   }
}
[root@ve10:Active] config  b rule myrule list
rule myrule {
   when HTTP_REQUEST {
   if {[HTTP::uri] equals "/portal/jsp/getSavedSearch.do"} {
      log local0. "match"
   } else {
      log local0. "not match"
   }
}
}

[root@ve10:Active] config  ssldump -Aed -nni 0.0 port 80
New TCP connection 1: 172.28.19.251(35857) <-> 172.28.19.79(80)
1341397520.6175 (0.0007)  C>S
---------------------------------------------------------------
HEAD /portal/jsp/getSavedSearch.do HTTP/1.1
User-Agent: Mozilla/4.5 [en] (X11; U; SunOS 5.6 sun4u)
Host: bpm.stubprod.com
Accept: */*
Referer: https://bpm.stubprod.com/portal/jsp/getSavedSearch.do
X-Forwarded-For: 10.80.65.145

---------------------------------------------------------------

[root@ve10:Active] config  tail /var/log/ltm
Jul  4 18:24:28 local/tmm notice tmm[5111]: 013e0001:5: Tcpdump starting bcast on :::0 from 127.1.1.1:42613
Jul  4 18:25:20 local/tmm info tmm[5111]: Rule myrule : match
Jul  4 18:25:42 local/tmm notice tmm[5111]: 013e0002:5: Tcpdump stopping on 127.1.1.2:26999 from 127.1.1.1:42613