Mar 27, 2026 - For details about updated CVE-2025-53521 (BIG-IP APM vulnerability), refer to K000156741.

Advanced iRules: Scan

Scan is used to parse out strings. It takes a string and based on your format parameters, stores the matches in one or more variables. It also returns the number of conversions performed, so it can b...
Updated Oct 02, 2023
Version 3.0
200
300
devops
irules
series-advanced-irules
JRahm's avatar
Icon for Admin rankAdmin
Christ Follower, Husband, Father, Technologist. I love community and I especially love THIS community. My background is networking, but I've dabbled in all the F5 iStuff, I'm a recovering Perl guy, and am very much a python enthusiast. Learning alongside all of you in this accelerating industry toward modern apps and architectures.
View Profile
Luis_Araujo_560's avatar
Luis_Araujo_560
Icon for Nimbostratus rankNimbostratus
Sep 16, 2017

@Jason,

 

Great job!!! This Tip help me a lot and I could to solve a ploblem that I had with SIP Header.

 

The SIP "Contact" Header have some "routerids", may be between six and eith into his. How I needed to use SNAT, the BIG-IP change the original IP into the "routers" and this caused a trouble to SIP comminication between client and SBC proxy, because the when the SBC received the packet, he sent back to the BIG-IP and not to the client.

 

Using your example I could save the routerid and the client IP into variables and replace that and the "routerid" into the SIP Response.

 

Follow my iRule:

 

when SIP_REQUEST {

 

set addr [IP::client_addr]

 

}

 

when SIP_RESPONSE {

 

 Check for 302 responses 
if {[SIP::response code] == 302} { 

    log local0. "302 OK"

    if {[scan [SIP::header value "Contact"] {%[^@]%[^,]%[^@]%[^,]%[^@]%[^,]%[^@]%[^,]%[^@]%[^,]%[^@]%s} a b c d e f g h i j k l] == 12} {

        log local0. "Parsed before change [SIP::header value "Contact"] into $a - $b - $c - $d - $e - $f - $g - $h - $i - $j - $k - $l"

        SIP::header remove "Contact" 

        SIP::header insert "Contact" "${a}@$addr>${c}@$addr>${e}@$addr>${g}@$addr>${i}@$addr>${k}@$addr>" 

        log local0. "Parsed after change [SIP::header value "Contact"] into $a - $b - $c - $d - $e - $f - $g - $h - $i - $j - $k - $l"
   }        
}

}

 

My question now is if rule can increase the load of CPU, because when I see the dump before Rule, the time to arraive the packet was 7ms and after the rule, 35ms.

 

Thanks a lot Luis Araujo