Hi,
There is some encoding errors in the above irule, try this one instead, it's the same with some fixed encoding chars :
when HTTP_REQUEST {
if { [HTTP::method] eq "POST" } {
Trigger the collection for up to 1MB of data
if { [HTTP::header Content-Length] ne "" and [HTTP::header value Content-Length] >= 1048576 } {
set content_length [HTTP::header value Content-Length]
} else {
set content_length 1048576
}
Check if $content-length is not set to 0
if { $content_length > 0 } {
HTTP::collect $content_length
}
}
}
when HTTP_REQUEST_DATA {
Do stuff with the payload
set payload "?[HTTP::payload]"
if {([URI::query $payload id] equals "sa_sabre") && (([URI::query $payload event] equals "sa_exchangeSrvr_state") || ([URI::query $payload event] equals "sa_sip_state"))} {
drop
}
}