Use iRulke to extract X-Forwarded out of HTTP packet

It would be more efficient to use an HTTP profile if you can. The alternative is to collect every TCP payload and insert the HTTP header in the TCP payload.

One option that could possibly work is to disable the HTTP profile after the HTTP headers of the first request have been parsed.

 
 when HTTP_REQUEST { 
  
     Insert XFF header 
    HTTP::header insert X-Forwarded-For [IP::client_addr] 
  
     Disable the HTTP profile for the rest of this TCP connection 
    HTTP::disable 
 } 
 

If that works, you should consider that the client may try to send multiple HTTP requests over the same TCP connection. Is this a possibility?

Aaron