Forum Discussion
Matt_Williamson
Nimbostratus
Mar 29, 2005iRule to persist on tcp_content
Hi all, I'm trying to write a rule that will search the first 2500 bytes of tcp_content for the "USERNAME=" string and then persist on the next 7 characters after that. Here is my original attempt. ...
unRuleY_95363
Mar 29, 2005Historic F5 Account
Ok, you have a couple of problems.
The first is that it appears you have typed the "rule {" portion into the GUI text box. When entering rules in the GUI, you must leave out the "rule {}" part of the rule. You enter the at the top and then enter the rule body (the when statements) in the text box.
When this gets saved into the config file, it then appears with the "rule {...}" part automatically added.
The second problem is how tcp_content now works in 9.0. In order for the tcp_content (which is really now called TCP::payload) to work, you must first specify how much you want to collect. In your case, it appears that you want to collect 2500 bytes. So, a rule that gathers 2500 bytes would look like this:
when CLIENT_ACCEPTED {
TCP::collect 2500
}
when CLIENT_DATA {
set usrid [findstr [TCP::payload] "USERNAME=" 9 "t"]
if {$usrid ne ""} {
persist uie $usrid
log local0. "Persisting $userid"
}
}
Hope this helps.
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects
