For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Ian_Johnson_382's avatar
Ian_Johnson_382
Icon for Nimbostratus rankNimbostratus
Jan 06, 2012

Seaching for string in tcp payload

Hi All, I am looking at creating an iRule to perform persistence based on a 32bit value in the tcp payload. I have create a iRule which is using the findstr to perform this and it is working, but...
application delivery
dev
devops
iRules
nitass's avatar
nitass
Icon for Employee rankEmployee
Jan 06, 2012
[root@ve1023:Active] config  b virtual bar list
virtual bar {
   snat automap
   pool foo
   destination 172.28.19.79:80
   ip protocol 6
   rules myrule
}
[root@ve1023:Active] config  b rule myrule list
rule myrule {
   when CLIENT_ACCEPTED {
        TCP::collect
}

when CLIENT_DATA {
        set payload [TCP::payload]
        binary scan $payload H* h_payload

        log local0. "\$h_payload: $h_payload"
        log local0. "32 bits data after 486f73743a: [findstr $h_payload 486f73743a 10 8]"

        TCP::release
}
}

[root@ve1023:Active] config  cat /var/log/ltm
Jan  6 09:08:10 local/tmm info tmm[26866]: Rule myrule : $h_payload: 474554202f20485454502f312e310d0a557365722d4167656e743a206375726c2f372e31352e352028693638362d7265646861742d6c696e75782d676e7529206c69626375726c2f372e31352e35204f70656e53534c2f302e392e3872207a6c69622f312e322e33206c696269646e2f302e362e350d0a486f73743a203137322e32382e31392e37390d0a4163636570743a202a2f2a0d0a0d0a
Jan  6 09:08:10 local/tmm info tmm[26866]: Rule myrule : 32 bits data after 486f73743a: 20313732