For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

lmiestc_26212's avatar
lmiestc_26212
Icon for Cirrus rankCirrus
Feb 05, 2010

Logging HTTP header that is longer than the maximum allowed

Hi Community,     Recently after an upgrade of our Portal I started to see occasional entries in the /var/log/ltm about   HTTP header (32800) exceeded maximum allowed size of 32768 and...
application delivery
dev
devops
iRules
hoolio's avatar
hoolio
Icon for Cirrostratus rankCirrostratus
Apr 28, 2011
Hi Raj,

 

 

As described above in this post, the connection is reset before HTTP_REQUEST is triggered. To capture this in an iRule you'd need to buffer on every TCP connection and look in the TCP payload for the HTTP headers. This wouldn't be very efficient.

 

 

I suggest using tcpdump to try to trap this. You can use a script like ringdump.pl to capture this:

 

 

http://devcentral.f5.com/tabid/1082223/aff/31/afv/topic/aft/1172521/afc/1173894/Default.aspx

 

 

Aaron