iRule inspecting body response

I think you can do something like:

STREAM::disable
STREAM::expression "this.location.replace("https://"
STREAM::enable

Then use the STREAM_MATCHED event:

when STREAM_MATCHED {
  log local0. "Stream found."
  }

You may need to play with it some, I can't remember exactly how to do this, but it can be done. You can search with stream and then NOT replace.

Hello when i try to log the payload of the response i can see that the output is in the following "format" : Iû¥ç€°¨±%¯$CØ=û¿ß‘_±CÒ$½ý¶¤ÑÌhæ7y¸V��œáš

�*ª|âL±O$:@|E¥¢.¼¢)+!ú”�¢µ KÛXR o˜2ӕÒ@‚ø¶!Õfׄ(ÃJW�P!³U„WÄ6¾ã N& $…+«×뵒)ÙòA03¿KؚÎ9•Ê«¹È--y-6S<,_Cÿ·_Â)

³5ýezÅÜö8µŸ.

How i can scan it successfully ? I expect that the response is an html format response.

Thank you.

Two possibilities:

 

1) the server is compressing the response 2) what you are looking at is a binary file: gif, png, jpeg, pdf, or something else like those.

 

You should also be able to do this by using a Content Profile HTML Rule. It can trigger the corresponding event you can use in an iRule.

 

https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ltm-profiles-reference-11-6-0/3.htmlreferenceid