Forum Discussion

Patti_G_72768's avatar
Patti_G_72768
Icon for Nimbostratus rankNimbostratus
Oct 29, 2013

Convert LOIC client rule to an iRule

Hi, here is another one I need to be able to convert from its original formatted rule into an iRule. This one needs to alert when a LOIC client has been detected. The requirements are to check for a ...
application delivery
devops
iRules
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Oct 29, 2013

Your iRule looks about right. To perform a case insensitive string match, convert the value to lowercase with [string tolower ]

if { [string tolower [HTTP::header User-Agent]] contains "blah" }

Also, just curious, but from what source are these "signatures" being defined? At this point I think you'll be better off employing a web application firewall to protect against types of attacks, instead of creating logic in iRules to cover specific attacks.