Attack signature Generic buffer overflow attempt 27 when uplod video

Hi Brain,

Try this out and see if it works for you.

I added in [string tolower[HTTP::uri]] so that your compare is in a known state (the URI Portion of a URL is case sensitive, so it is a good habit to get into to take account for it).

I also added in a logging statement, so if it finds a qualifying event it will log it into the /var/log/ltm log along with the Client IP Address.

when HTTP_REQUEST {
if { [string tolower [HTTP::uri]] starts_with "/cfide" } {
log local0. "Blocking access to "/CFIDE".  Traffic dropped from [IP::client_addr]"
drop
}
}

Hope this helps.

Thanks, Michael, for getting back to me and I've added in your code with one minor correction for a double-quote. I wish I could report that the event was now firing but sadly, it still isnt. Could it have anything to do with the SSL decryption that has to occur via the offload (e.g., it hasnt decrypted the request so it doesnt see the GET for CFIDE)?

Yes. If the traffic is encrypted then the iRule cannot process successfully.

OK, I tested it with another vs and it worked as expected. Further investigation revealed that there were actually two VS' created for two IPs on that system and I was only working on the one IP. Once I added it to the 2nd VS (the right one), it worked as expected. Thanks for taking the time to assist.