How to capture the last ip address written in my x forwarded for header.

Hello,

Try this, irule is simple, you can begin with this and if you need more details or more specification le me now...

when HTTP_REQUEST {

foreach header [HTTP::header names] {

    log local0. "HTTP Header : $header = [HTTP::header values $header]"

    if {$header == "X-Forwarded-For"} {
         in xff it will set the last value of X-Forwarded-For
        set xff "[HTTP::header values $header]"
    }

}
}

Regards

Hi

Assuming that your XFF header has a common delimiter eg comma, then you could use something like this

when HTTP_REQUEST {

    if {HTTP::header exists X-Forwarded-For } {

        Logic assumes that the header is delimited with a comma
        set xff [string trim [lindex [split [HTTP::header values X-Forwarded-For] ,] end]]
        log local0. "XFF Last Entry = $xff"
    }
}