Forum Discussion
mattrm_59122
Nimbostratus
NimbostratusTCP payload match and logging
Hi All,
I'm trying to reference TCP client data and look for userid and timestamp and log these values, I also need to log which LB Select.
I have the first part, (i think), but what do I do to find those values in client data and the log those values.
when CLIENT_ACCEPTED {
TCP::collect
}
when CLIENT_DATA {
if { [TCP::payload] contains "userid=", "timestamp=" } {
}
}
13 Replies
mattrm_59122Currently I'm matching the value
however I'm rewriting actual passwords as well as null or empty ones. Sigh üôÇUserpassword=
M- mattrm_59122Hi Just an update to the iRule, below is the working version:
Using the following stream profile:
@Username.*Userpassword=\n@@when STREAM_MATCHED {log each match found by the stream filterscan [STREAM::match] "Username=%s" userlog local0. "Username [b64decode $user] had passwordreplaced"STREAM::replace "Username=$user\nUserpassword=0000=\n"}when LB_SELECTED {set serverIP [LB::server addr]log local0. "LB Server IP $serverIP"}Matt - Very cool, thanks for sharing!
Colin
