For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Atul_kumar_1994's avatar
Atul_kumar_1994
Icon for Nimbostratus rankNimbostratus
May 11, 2015

irule is unable to block all of the unwanted UDP syslog messages which is not there in the string filter

Please see the below irule when CLIENT_ACCEPTED { UDP::payload replace 0 0 [binary format ssssa256 255 255 255 255 [string repeat "~" 256]] if { [class match [UDP::payload] contains syslog_s...
Max_Q_factor's avatar
Max_Q_factor
Icon for Cirrocumulus rankCirrocumulus
May 12, 2015

It sounds like the F5 may treat multiple messages as a single UDP connection. Have you created a specific UDP profile for the syslog servers and changed the timeout value to immediate?

 

SOL7535: Overview of the UDP profile