Forum Discussion

ksuuk's avatar
ksuuk
Icon for Nimbostratus rankNimbostratus
May 27, 2018

Compare user-agent content and then match?

Hi, I'm looking solution to match botnets width fake user-agent and width fake user-agent syntax. First check, is the user-agent complete: Mozilla/5.0 (Linux; Android 4.4.2; SM-G7102 Build/KOT...
iRules
LTM
security
Simon_Blakely's avatar
Simon_Blakely
Icon for Employee rankEmployee
May 27, 2018

If it were me, I'd check the user agent against a datagroup of known valid user agents (lists are available if you google).

 

Otherwise, you need to learn how to extract substrings from the user-agent using TCL scan or TCL regular expressions (tip - scan is faster than regexp).

 

Advanced iRules: Scan

 

I'll also note that DoS Profiles available with modules like ASM and AFM have User-Agent signatures for Bot detection.