Forum Discussion

Spidey_29396's avatar
Spidey_29396
Icon for Nimbostratus rankNimbostratus
Dec 26, 2013

Is there a way to extract a payload(body day) as a reference for load balancing?

Hi All,

is there any other way to extract data from payload?

i am currently using this but it's not working:

when HTTP_REQUEST { if { [HTTP::header "profileId"] equals "825" } { pool CMSv10_login_pool } else { pool cms_v10_pool }

had done some tcpdump to extract the payload,

0x0130:  454e 2220 636f 756e 7472 793d 2275 7322  EN".country="us"
0x0140:  2070 726f 6669 6c65 4964 3d22 3832 3522  .profileId="825"
0x0150:  206c 6f63 616c 697a 6174 696f 6e3d 2247  .localization="G
0x0160:  4d54 2b30 2220 7472 616e 7361 6374 696f  MT+0".transactio

we need the profile id as reference to load balancing.

Thanks! Ferdz

7 Replies

  • Hi Nitass,

     

    thank you for this. i am encountering some error on this part, i need to extract

     

    0x0140: 2070 726f 6669 6c65 4964 3d22 3832 3522 .profileId="825"

     

    when HTTP_REQUEST_DATA { if {[HTTP::payload] contains ".profileId="825""} { <------- double quote log local0. "User redirected" pool pool_tets } else { pool pool_tets } }

     

  • Hi Nitass,

     

    thank you for this. i am encountering some error on this part, i need to extract

     

    0x0140: 2070 726f 6669 6c65 4964 3d22 3832 3522 .profileId="825"

     

    when HTTP_REQUEST_DATA { if {[HTTP::payload] contains ".profileId="825""} { <------- double quote log local0. "User redirected" pool pool_tets } else { pool pool_tets } }

     

  • can you try backslash before double quote?

    by the way, i do not think period (.) is in payload. 0x20 is space (not period).

    e.g.

     configuration
    
    root@(ve11a)(cfg-sync In Sync)(Active)(/Common)(tmos) list ltm virtual bar
    ltm virtual bar {
        destination 172.28.20.15:80
        ip-protocol tcp
        mask 255.255.255.255
        profiles {
            http { }
            tcp { }
        }
        rules {
            myrule
        }
        source 0.0.0.0/0
        source-address-translation {
            type automap
        }
        vs-index 29
    }
    root@(ve11a)(cfg-sync In Sync)(Active)(/Common)(tmos) list ltm rule myrule
    ltm rule myrule {
    when HTTP_REQUEST {
      if { [HTTP::method] equals "POST" } {
        if {[HTTP::header exists "Content-Length"] && [HTTP::header "Content-Length"] <= 1048576} {
          set content_length [HTTP::header "Content-Length"]
        } else {
          set content_length 1048576
        }
        HTTP::collect $content_length
      }
    }
    when HTTP_REQUEST_DATA {
      log local0. "payload [HTTP::payload]"
      if  { [HTTP::payload] contains "profileId=\"825\"" } {
        pool A_pool
      } else {
        pool B_pool
      }
    }
    when HTTP_RESPONSE {
      log local0. "cs [IP::client_addr]:[TCP::client_port] > [clientside {IP::local_addr}]:[clientside {TCP::local_port}] ss [IP::local_addr]:[TCP::local_port] > [IP::remote_addr]:[TCP::remote_port] pool [LB::server pool]"
    }
    }
    root@(ve11a)(cfg-sync In Sync)(Active)(/Common)(tmos) list ltm pool A_pool
    ltm pool A_pool {
        members {
            200.200.200.101:80 {
                address 200.200.200.101
            }
        }
    }
    root@(ve11a)(cfg-sync In Sync)(Active)(/Common)(tmos) list ltm pool B_pool
    ltm pool B_pool {
        members {
            200.200.200.111:80 {
                address 200.200.200.111
            }
        }
    }
    
     testing
    
    [root@ve11a:Active:In Sync] config  tail -f /var/log/ltm
    Dec 25 23:39:26 ve11a info tmm[2836]: Rule /Common/myrule : payload country="us"profileId="825"localization="GMT+0"
    Dec 25 23:39:26 ve11a info tmm[2836]: Rule /Common/myrule : cs 172.28.20.20:47120 > 172.28.20.15:80 ss 200.200.200.14:47120 > 200.200.200.101:80 pool /Common/A_pool
    
    Dec 25 23:39:34 ve11a info tmm1[2836]: Rule /Common/myrule : payload country="us"profileId="999"localization="GMT+0"
    Dec 25 23:39:34 ve11a info tmm1[2836]: Rule /Common/myrule : cs 172.28.20.20:47121 > 172.28.20.15:80 ss 200.200.200.14:47121 > 200.200.200.111:80 pool /Common/B_pool