Forum Discussion
hooleylist
Jul 27, 2009Cirrostratus
It would be more efficient to use an HTTP profile if you can. The alternative is to collect every TCP payload and insert the HTTP header in the TCP payload.
One option that could possibly work is to disable the HTTP profile after the HTTP headers of the first request have been parsed.
when HTTP_REQUEST {
Insert XFF header
HTTP::header insert X-Forwarded-For [IP::client_addr]
Disable the HTTP profile for the rest of this TCP connection
HTTP::disable
}
If that works, you should consider that the client may try to send multiple HTTP requests over the same TCP connection. Is this a possibility?
Aaron