Categorize SSL traffic by version, display as graph

[David_Holmes_12]

Problem this snippet solves:

You want to know how much SSLv3 traffic is hitting your site. Example image when going to https://x.x.x.x/sslversions:

How to use this snippet:

Attach this iRule to your virtual server that is terminating SSL. It will collect statistics about which versions of SSL are being negotiated with clients. Use the 'istats dump' command to see the statistics. Or, connect to your virtual server and query for "/sslversions" to see a javascript graph.

---

Code :

when CLIENTSSL_HANDSHAKE {
        ISTATS::incr "ltm.virtual [virtual name] c [SSL::cipher version]" 1
    }
when HTTP_REQUEST {
        if { [string tolower [HTTP::uri]] equals "/sslversions" } {
            set v3 [ISTATS::get "ltm.virtual [virtual name] c SSLv3"]
            set t10 [ISTATS::get "ltm.virtual [virtual name] c TLSv1"]
            set t11 [ISTATS::get "ltm.virtual [virtual name] c TLSv1.1"]
            set t12 [ISTATS::get "ltm.virtual [virtual name] c TLSv1.2"]
            set hbody "\n \
  \n \
    \n \
    \n \
    \n \
  \n \
\n \
  \n \
    \n \
    \n \
  \n \
\n \
"
            HTTP::respond 200 content $hbody
        }
    }

[Brandon_30711]

Love it David! Great example use of iStats. You may want to move the magic URI to an internal VIP to not advertise to people (read potential bad actors) what you traffic distribution looks like.

[Roflcopter]

Would be good to get a counter next to the percentages. Only thing I added to this was so that external IP's couldn't get to the /sslversions on virtual servers that we have externally facing. when HTTP_REQUEST { if { [string tolower [HTTP::path]] contains "/sslversions" } { if { !([matchclass [IP::client_addr] equals ssl_stats])} { discard } ssl_stats is a data group list

[prt1969_120570]

Based on Brandon's comment above, any feedback on what a modified script would look like to either send the /sslversions URI to another VIP or even via High Speed Logging to another destination?