Forum Discussion
wlepkin_98758
Nimbostratus
Nimbostratusstring range arguments
Hi, I'm trying to capture the first x-forwarded-for header value in an http request. There's probably a more efficient way to do this, but this is what I came up with:
when HTTP_REQUEST {
...
hooleylist
Cirrostratus
CirrostratusHi Wayne,
Can you try this to get the first xff IP:
when HTTP_REQUEST {
scan [HTTP::header values x-forwarded-for] {%d.%d.%d.%d%*s} a b c d
set first_xff $a.$b.$c.$d
}
Aaron