Forum Discussion
Hurting eyes, could someone check this?
Hey all,
Running 9.0.5, I have these rules in place:
rule cyclone_ftp_hhtp_request {
when HTTP_REQUEST {
if { [HTTP::uri] contains "ftp" } {
node 192.168.250.144...
Well, it looks like you're using the IP::protocol command where you'd probably want to use something closer to TCP::client_port
The IP::protocol command doesn't return the port address of the transfer protocol you're using, it returns the actual value of the protocol field.
There's a decent list of them here: Click here
So, you'd want to change your two FTP rules to look more like:
when CLIENT_ACCEPTED {
if { [TCP::client_port] == 21 } {
node 192.168.250.128
} else {
pool cyclonetest
}
}And:
when CLIENT_ACCEPTED {
if { [TCP::client_port] == 21 } {
node 192.168.250.144
} else {
pool cycloneprod
}
}HTH,
-Colin
