Forum Discussion
Match string "username" inside TCP:Payload
I have a requirement to extract Client IP address as soon as VIP sees a LDAP Bind request from a particular username.
I have gone through couple of forums and found this relevant:
when CLIENT_ACCEPTED {
TCP::collect 100
}
when CLIENT_DATA {
# check if payload contains the string we want to replace
if { [TCP::payload ] contains "username_adam" } {
#logging Client ip as soon as see bind request coming from username adam
log local0. "Client ip logged is [IP::client_addr]"
TCP::release
TCP::collect
}
Any answers and help would be appreciated.
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com