Forum Discussion
Jonathan_Landis
Nimbostratus
NimbostratusMultiple message-header fields with the same field-name
The following rule logs the "Cookie" header of http requests:
when HTTP_REQUEST {
set ch [HTTP::header "Cookie"]
if {$ch != ""} {log local0. "$ch"} else {log local0. "no cookie"...
Jonathan_LandisNimbostratus
NimbostratusThanks, Joe! Sometimes there are multiple "Accept" headers as well. Is there a way to collect all of them?
