Forum Discussion
doddy
Jul 27, 2013Nimbostratus
Detect HTTP Pipelining Request
Good day all...
I am currently looking for method to detect HTTP pipelining request. This pipelining is currently exploiting our vulnerability in which cannot detect subsequent request on...
doddy
Jul 27, 2013Nimbostratus
Hi Kevin & Nitass,,many thanks for helping me with disabling pipelining idea. But I still need to ensure the behavior.
You said that "when pipelining is disabled, bigip will terminate a connection after responding 1st request". Does this mean bigip will close the socket created before to handle the first request? Or does it mean that bigip simply ignore the subsequent request in which delimited with "\r\n" character?
Let me add more info regarding my case. So there was HTTP pipeline request that is suspected being used for this purpose:
1. The first request is the legitimate HTTP request, in which requesting the web page that the client truly want to visit
2. The second request (or the third, fourth, and so forth if exist) is used to trick the DPI system, in which read for certain pattern and in fact cannot detect if pipeline is being used.
So the bigip is located behind the DPI system on the client perspective.
That is why I need the bigip to detect if the request is in pipeline form or not, and reject the request totally (first and subsequent) if so.
But I cannot implement the CLIENT_ACCEPTED and CLIENT_DATA event as you suggest, since the same VS used currently need to run another HTTP inspection using HTTP_REQUEST event.
I will also test the disable pipelining on my network and let you know if the behavior meets my expectation.
Thanks again :)
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects