Forum Discussion

OTS02's avatar
OTS02
Icon for Cirrus rankCirrus
Apr 18, 2015

stream profile to detect only?

Can a stream profile be used to simply detect a unique string of characters, without actually replacing that string? If so, could you point me to an example of how to accomplish this? I would like to...
Kevin_Davies_40's avatar
Kevin_Davies_40
Icon for Nacreous rankNacreous
Apr 19, 2015

Try this.

when HTTP_RESPONSE {     
   STREAM::disable 
   if {[HTTP::header value Content-Type] contains "text"}{ 
      STREAM::expression {&http://.*?example\.com&}
       Enable the stream filter for this response only 
      STREAM::enable 
   } 
}  

when STREAM_MATCHED { 
   log local0. "[IP::client_addr]:[TCP::local_port]: matched: [STREAM::match]" 
}