Forum Discussion

OTS02's avatar
OTS02
Icon for Cirrus rankCirrus
Apr 18, 2015

stream profile to detect only?

Can a stream profile be used to simply detect a unique string of characters, without actually replacing that string? If so, could you point me to an example of how to accomplish this? I would like to examine TNS traffic to/from an Oracle server and log matches.

 

4 Replies

  • Kevin_Davies_40's avatar
    Kevin_Davies_40
    Icon for Nacreous rankNacreous
    Apr 19, 2015

    Try this.

    when HTTP_RESPONSE {     
   STREAM::disable 
   if {[HTTP::header value Content-Type] contains "text"}{ 
      STREAM::expression {&http://.*?example\.com&}
       Enable the stream filter for this response only 
      STREAM::enable 
   } 
}  

when STREAM_MATCHED { 
   log local0. "[IP::client_addr]:[TCP::local_port]: matched: [STREAM::match]" 
}
  • OTS02's avatar
    OTS02
    Icon for Cirrus rankCirrus
    Apr 30, 2015

    Thanks Kevin,

     

    I now need to look into the payload of strictly TCP (TNS between servers and Oracle database). Any pointers?