For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

ksuuk's avatar
ksuuk
Icon for Nimbostratus rankNimbostratus
May 27, 2018

Compare user-agent content and then match?

Hi, I'm looking solution to match botnets width fake user-agent and width fake user-agent syntax. First check, is the user-agent complete: Mozilla/5.0 (Linux; Android 4.4.2; SM-G7102 Build/KOT...
iRules
LTM
security
Simon_Blakely's avatar
Simon_Blakely
Icon for Employee rankEmployee
May 27, 2018

If it were me, I'd check the user agent against a datagroup of known valid user agents (lists are available if you google).

 

Otherwise, you need to learn how to extract substrings from the user-agent using TCL scan or TCL regular expressions (tip - scan is faster than regexp).

 

Advanced iRules: Scan

 

I'll also note that DoS Profiles available with modules like ASM and AFM have User-Agent signatures for Bot detection.