For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

hoolio's avatar
hoolio
Icon for Cirrostratus rankCirrostratus
Feb 26, 2009

Using HTTP::payload with/without HTTP::collect/HTTP_REQUEST_DATA?

Citizen_elah suggested you could use 'HTTP::payload length' in HTTP_RESPONSE in this recent post (Click here). I didn't realize you could use HTTP::payload length outside of HTTP_REQUEST_DATA or HTTP...
application delivery
dev
devops
iRules
spark_86682's avatar
spark_86682
Historic F5 Account
Feb 27, 2009

I always thought these two events were triggered when only the HTTP headers had been parsed.

 

 

 

They are; your understanding is correct. The key to this is that it's quite common for an HTTP server to send the start of the data in the same packet as the end of the headers, so it's not surprising that there's some amount of payload at the moment when all of the headers are received by the LTM.

 

 

I don't know when this happened, but I'd be surprised if it's very new. It looks like it works in v9.3.0+ at the very least, possibly earlier versions as well.