For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

superd_88943's avatar
superd_88943
Icon for Nimbostratus rankNimbostratus
Jun 05, 2014

iRule for logging client version

Hi,

 

Im looking to create an iRule which logs traffic when it sees the client requests coming from IEv6 only.

 

Basically im trying to figure out how many IEv6 clients are on my network.

 

Also how can i prevent multiple entries from the same client, is that possible, or alternatively log the IP address as well so i can draw up some kind of report.

 

Thanks in advance! - dave

 

V11.2

 

application delivery
devops
iRules

7 Replies

  • Eric_St__John's avatar
    Eric_St__John
    Icon for Employee rankEmployee
    Jun 05, 2014

    What about using istats to increase a counter for the specific virtual server that you apply the iRule to?

    when HTTP_REQUEST {
  set clientip [IP::client_addr]
  if { [HTTP::header "User-Agent"] contains "MSIE 6.0" } {
    ISTATS::incr "ltm.virtual /Common/VIRTUAL_NAME counter $clientip" 1
    }
}

    You can then check the counters for the stats on a per VS basis.

    Article on iStats

    iStats Wiki

    Eric

  • superd_88943's avatar
    superd_88943
    Icon for Nimbostratus rankNimbostratus
    Jun 06, 2014

    Thanks a milliom eric.. ill run this through test f5 :)

     

    can i ask where the stats are outputted to?

     

  • superd_88943's avatar
    superd_88943
    Icon for Nimbostratus rankNimbostratus
    Jun 06, 2014

    Hi,

     

    Am i following the right track here, after enabling the iRule on the relevant VS.

     

    I am running the below command, and get following output. Which doesnt look to be providing the output ive hoped. Am i looking for the stats in the wrong place maybe?

     

    show ltm pool /Common/websense-v10000

     

    Ltm::Pool: websense-v10000

    Status Availability : available State : enabled Reason : The pool is available Monitor : min 1 of /Common/gmail_test /Common/http Minimum Active Members : 0 Current Active Members : 1 Total Requests : 33938 Current Sessions : 85

     

    Traffic ServerSide Bits In 590.0M Bits Out 4.5G Packets In 374.3K Packets Out 567.1K Current Connections 5 Maximum Connections 60 Total Connections 19.9K

     

    Connection Queue Pool Pool and members Number of connections queued now 0 0 Number of connections serviced 0 0 Queue head entry age (ms) 0 0 Maximum queue entry age ever (ms) 0 0 Maximum queue entry age recently (ms) 0 0 Average queue entry age (ms) 0 0

     

    • Eric_St__John's avatar
      Eric_St__John
      Icon for Employee rankEmployee
      Jun 06, 2014
      My apologies, there was a slight error in the iRule above, I missed the 'counter' in the ISTATS::incr command. Please try the updated iRule above. Once that is corrected, you should see something similar to below added to the output of 'show ltm pool /Common/websense-v10000' User-defined Value 192.168.2.116 5 Eric
    • nitass's avatar
      nitass
      Icon for Employee rankEmployee
      Jun 08, 2014
      the istats should be added to output of show virtual (i.e. show ltm virtual ...).
  • superd_88943's avatar
    superd_88943
    Icon for Nimbostratus rankNimbostratus
    Jun 10, 2014

    Thanks guys.. im not seeing anything with either command:

     

    show ltm virtual

     

    show ltm pool /Common/websense-v10000

     

    Any ideas.. troubleshooting wise?

     

    • Eric_St__John's avatar
      Eric_St__John
      Icon for Employee rankEmployee
      Jun 10, 2014
      Did you utilize the corrected iRule above? There was a change that I made to the iRule. As nitass mentioned, the command to look at the counters is: show ltm virtual VIRTUALNAME If you've changed the iRule accordingly, and it still isn't working, please paste the iRule and any logs when a MSIE 6 user attempts to connect to the virtual server. It would also be helpful for you to paste the configuration of the virtual, as the iRule above assumes that these are HTTP connections, which expose the User-Agent string needed to determine the browser type. Eric