For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

beefy80's avatar
beefy80
Icon for Nimbostratus rankNimbostratus
Mar 24, 2014

Logging payload length and part of message

Hello

 

I am looking into logging a TCP request and response through an iRule. I am happy with performing the logging in an iRule as I have done this before but this is the first time I have tried to capture payload. First of all I want to look at collecting the message length of both the request from the client and the response from the server. Secondly I would like to capture a reference from the a certain position within the message. This is always in the same position of the message as that part is fixed length. The actual message contains a two byte header that logs the message size calculated by the application an example is: 0x00 0x09 STX Message ETX What would be useful is to log the actual message length received by both the client and server secondly logging the length in the request from the client and response from the server. The message reference mentioned above only needs to be collected from the request message from the client and does not need to be captured from a server response.

 

Any help would be appreciated.

 

application delivery
devops
iRules
LTM

1 Reply

  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Mar 24, 2014

    Given that you want to see client request and server response sizes, you could do something like this:

    when CLIENT_ACCEPTED {
    TCP::collect
}
when CLIENT_DATA {
    set cs_len [TCP::payload length]
    set cs_payl [TCP::payload]
    TCP::release
}
when SERVER_CONNECTED {
    TCP::collect
}
when SERVER_DATA {
    set ss_len [TCP::payload length]
    set ss_payl [TCP::payload]

    log local0. "Client side ($cs_len) = $cs_payl, Server side ($ss_len) = $ss_payl"

    TCP::release
}

    This is logging the entire request and response payloads, so you'd need to customize as required.