Detect SSLv3 and Create a list of incoming IP addresses using SSLv3

You should already have what you're looking for with the exception of an additional log line:

when CLIENT_ACCEPTED { 
    log local0. "[IP::client_addr]" 
    if { [class match [IP::client_addr] equals SSLv3_Client] } {
        log local0. "Incoming SSLv3 client: [IP::client_addr]" 
        SSL::profile ADC_LDAP_SSL3 
    } else { 
        SSL::profile ADC_LDAP 
    }
}

or are you trying to log all clients that establish an SSLv3 connection (versus what's defined in the datagroup)?

But one of the testers said it was not working.

Can you elaborate on how it's not working? Was it breaking page access? Not logging the SSLv3 connection?

Hi Kevin

Here is what I got from our developer -

It seems to me when the call from the oracle databases to the site, the condition “if {[SSL::cipher version] eq "SSLv3"}” does not work, or at least it cannot get the cipher version

Thanks

Chung

Understood, but if you do the following, do you see any ciphers listed:

when CLIENTSSL_HANDSHAKE { 
    log local0. "[IP::client_addr] - [SSL::cipher version]"
}

Awesome, thanks alot, it is working for me.

Regards

chung