Forum Discussion
7 Replies
Sort By
For a very quick solution to match on a single source IP and URI, you could use the following:
when HTTP_REQUEST { if { ( ( [IP::addr [IP::client_addr] equals X.X.X.X] ) && ( [string tolower [HTTP::uri]] contains "xyz" ) ) } { drop } }
However, if you need need it to be more scalable, I would probably use a data group to hold multiple client IP addresses and then maybe another data group or switch -glob statement to match on multiple URIs.
I'd just advise to avoid using "string tolower" on HTTP uri instruction, since path is case sensitive.
Good point 👍
- MaxMedovCirrostratus
I'll test it thank you!