Forum Discussion
J_Saunders_4728
Nimbostratus
NimbostratusReject based on string in HTTP header
All,
I want the F5 to reject (or drop) packets that have specific string/text in the HTTP header. I found this:
when HTTP_REQUEST {
if { [HTTP::header exists Morfeus Scanner] } {
reject
}
}
When I try to add the above iRule I get an error that there are too many arguments in line 2. I removed the second word (Scanner) and it accepted the iRule. BUT, I would prefer to have both words included. Is there a way to do that? Do I use quotes?
Thanks
3 Replies
- Kevin_Stewart
Employee
Try this:when HTTP_REQUEST { foreach header {Morfeus Scanner} { if { [HTTP::header exists $header] } { log local0. "Caught $header header" reject } } }
The [HTTP::header exists ] command just works on the name of the header, so if you want to capture a header with "Morfeus" or "Scanner" in the value you'll need to modify the iRule. 
J_Saunders_4728Thanks. Will give it a try and update this thread.- Arie
Altostratus
If it's likely that you will want to block on additional values in the future you may want to consider using a class (Data Group). Just keep in mind that the class and/or values won't be available when you save the class.
