For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Sathishkumar123's avatar
Sathishkumar123
Icon for Nimbostratus rankNimbostratus
Oct 20, 2017

TCP::Collect vs TCP::payload

I have a simple iRule as below   when CLIENT_ACCEPTED {TCP :: collect}   when CLIENT_DATA { if { [TCP::payload] contains "SomeName/SomeServiceNameHere/"} { pool APoolUsedByMyApplication }   ...
application delivery
BIG-IP
iRules
Kai_Wilke's avatar
Kai_Wilke
Icon for MVP rankMVP
Oct 20, 2017

Hi Sathishkumar123,

the 

[TCP::collect 100]
command will make sure that you've buffered at least 100 bytes of data before the 
CLIENT_DATA
event triggers. If more TCP payload data has been already arrived in the TCP buffer the 
[TCP::payload]
command would be able to access this data too. And if less that 100 bytes of data has been already arrived, it will wait until the remaining data has been arrived (Note: This may stall your TCP connection if the client is requiring a response before sending additional data)

The 

[TCP::payload 250]
command will read a maximum of 250bytes from the TCP buffer. If more data is available in the TCP buffer it will accurately trunkate the payload for you. And if less that 250bytes of data are currently in the TCP buffer, it will simply fetch all available data without any complains...

Cheers, Kai