Forum Discussion
mattrm_59122
Nimbostratus
NimbostratusTCP payload match and logging
Hi All,
I'm trying to reference TCP client data and look for userid and timestamp and log these values, I also need to log which LB Select.
I have the first part, (i think), but what do I do to find...
mattrm_59122Nimbostratus
NimbostratusGot this working with regex, however probably not the best way going forward. I'd like to use findstr or matchstr instead, but having some teething issues around that.
when STREAM_MATCHED {
log each match found by the stream filter
log local0. "Stream filter matched:[STREAM::match]"
set myvar [STREAM::match]
set 4 "blah"
regexp {Username=(.+)\sUserpassword=(.+)\sUseremail=(.+)\sUserhomefolder=(.+)\s} $myvar matched sub1 sub2 sub3
log local0. "Username=[b64decode $sub1] Userpassword=[b64decode $sub2] Usermail=[b64decode $sub3]"
}
when LB_SELECTED {
set serverIP [LB::server addr]
log local0. "LB Server IP $serverIP"
}
