FINDING A STRING IN HTTP HEADER

Can you specify what HTTP Header the content will be in? Are you sure you don't mean that "bid=" is in the URI? If it is in the URI (ie. http://www.foo.com/somepage.cgi?bid=4&something_else).

If it's in the URI, then something like this should work:

when HTTP_REQUEST {
  if { [HTTP::uri] contains "bid=" } {
    pool some_pool
  } else {
    discard
  }
}

If it's in a named header, then you could use this

when HTTP_REQUEST {
  if { [HTTP::header "HeaderName"] contains "bid=" } {
    pool some_pool
  } else {
    discard
  }
}

If your string is in the POST data for a form, then you are going to want to look in the HTTP::payload as shown in the previous post.

-Joe