Forum Discussion
hooleylist
Jul 29, 2007Cirrostratus
Hi Tal,
Having ASM shouldn't actually change how you do this. You can look in the response for cookies starting with TS. Here is an example:
when HTTP_RESPONSE {
only look for TS cookies if it's a response to the specific client
if {[IP::addr [IP::client_addr] equals 1.2.3.4]}{
loop through cookie names
foreach aCookie [HTTP::cookie names] {
log cookie names and values that start with TS
if { $aCookie starts_with "TS"}{
log local0. "client: [IP::client_addr] has cookie $aCookie=[HTTP::cookie value $aCookie]"
}
}
}
}
Aaron