# iRule to extract XFF IP address in HTTP Packet

**URL:** <https://community.f5.com/t/irule-to-extract-xff-ip-address-in-http-packet/62542>\
**Category:** Technical Forums\
**Tags:** devops, big-ip, xff, ltm, application-delivery\
**Created:** [July 24, 2018, 7:02am UTC](https://community.f5.com/t/irule-to-extract-xff-ip-address-in-http-packet/62542 "2018-07-24T07:02:27Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nath](https://avatars.discourse-cdn.com/v4/letter/n/b38774/32.png) [@Nath](https://community.f5.com/u/Nath)\
**Post date:** [July 24, 2018, 7:02am UTC](https://community.f5.com/t/irule-to-extract-xff-ip-address-in-http-packet/62542/1 "2018-07-24T07:02:27Z")

</div>

Hi do you have any idea how I can extract XFF IP address in a packet using iRule or in LTM.

Thanks,

---

<div class="post-metadata">

**Author:** ![Samir\_Jha\_52506](https://avatars.discourse-cdn.com/v4/letter/s/a6a055/32.png) [@Samir\_Jha\_52506](https://community.f5.com/u/Samir_Jha_52506)\
**Post date:** [July 24, 2018, 8:03am UTC](https://community.f5.com/t/irule-to-extract-xff-ip-address-in-http-packet/62542/2 "2018-07-24T08:03:10Z")

</div>

There is an iRule to extract client IP address.

```tcl
when HTTP_REQUEST {
         HTTP::header insert X-Forwarded-For [IP::remote_addr]
          }

```

Go through f5 article [K4816](https://support.f5.com/csp/article/K4816)

Hope it will help you..

---

<div class="post-metadata">

**Author:** ![Surgeon](https://avatars.discourse-cdn.com/v4/letter/s/ce73a5/32.png) [@Surgeon](https://community.f5.com/u/Surgeon)\
**Post date:** [July 24, 2018, 8:17am UTC](https://community.f5.com/t/irule-to-extract-xff-ip-address-in-http-packet/62542/3 "2018-07-24T08:17:22Z")

</div>

```tcl
when HTTP_REQUEST {
   log local0. "X-Forwarded-For: [HTTP::header X-Forwarded-For]"
}

```

---

<div class="post-metadata">

**Author:** ![Andy\_McGrath](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/andy_mcgrath/32/28642_2.png) [@Andy\_McGrath](https://community.f5.com/u/Andy_McGrath)\
**Post date:** [July 24, 2018, 9:47am UTC](https://community.f5.com/t/irule-to-extract-xff-ip-address-in-http-packet/62542/4 "2018-07-24T09:47:46Z")

</div>

Take at look at the following code snippet [XFF Universal Persistence iRule](https://devcentral.f5.com/codeshare/xff-universal-persistence-irule).

It is for persistence but you can change from persist to log or anything else you want to do with the XFF header data.