For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

TJ_Vreugdenhil's avatar
TJ_Vreugdenhil
Icon for Cirrus rankCirrus
Aug 20, 2010

HTTPS 1.1 Custom Monitor using receive string

Hello F5 ADV Community:

 

 

I am running into a issue with a custom HTTPS monitor. A voltage server I have this monitor assigned to, is reporting syslog 'java servlet errors'. I have followed SOL3224 to create a custom HTTPS monitor for 10.1.0

 

 

Custom HTTPS monitor:

 

defaults from https

 

send "GET / HTTP/1.1\r\nHost: \r\nConnection: Close\r\n\r\n"

 

 

I switched over to a basic TCP monitor, but we are still seeing the syslog errors reported by voltage. I would like to try to craft a HTTPS monitor to look for a specific string of text, and try to stay away from any type of java connection.

 

 

Do you think the following HTTPS monitor looks right, and would meet my needs, or would you suggest something different?

 

 

SEND STRING:

 

send "GET / HTTP/1.1\r\nHost: voltage-ps-0000.xxxxxxxx.com/login Close\r\n\r\n

 

 

 

RECEIVE STRING:

 

Email Encryption Provided by Voltage SecureMail

 

 

Thanks!

 

 

-Tj

 

 

 

 

 

 

config
design

1 Reply

  • Hamish's avatar
    Hamish
    Icon for Cirrocumulus rankCirrocumulus
    Aug 20, 2010
    Hi WHPH...

    Your host: header should just have the FQDN in it... And nothing else. You've got a URI appended to it... I'd make the monitor SEND string 

    
  GET /login HTTP/1.1\r\nhost: voltage-ps-0000.domain.com\r\nConnection: close\r\n\r\n

    although the connection close shouldn't be needed because the F5 will close it anyway. The actual URI required (I've use /login above) is going to depend on exactly what the voltage server is expecting... It might be required to snoop the URI's being sent and if any other headers are required to complete the request properly.

    H