Forum Discussion

JCaine's avatar
JCaine
Icon for Altocumulus rankAltocumulus
Aug 21, 2020
Solved

Request logging profile on non-HTTP traffic

Hello,   While writing an iRule to perform HTTP requests and responses logging via HSL commands, I discovered the Request (responses) logging profile which appears to be a better choice :) Now, ...
iRules
LTM
security
  • Dario_Garrido's avatar
    Dario_Garrido
    Aug 21, 2020

    Hello JCaine.

     

    Request-logging is only for HTTP traffic. If non-HTTP is your scenario, then forget the request-logging solution.

    REF - https://support.f5.com/csp/article/K00847516

     

    In you case the only solution is to use iRules (better with HSL than Remote logging)

     

    F5 profiles work as OSI layer parsers. If you have an TCP VS, only TCP headers will be parsed (you are able to use any TCP::xxx command). If you assign an HTTP to this VS, app header will be also parsed (and you will be able to use HTTP::xxx commands), the same for any other profile: TLS, SMTP, DCHP.

     

    What if you have a custom protocol which runs over TCP? Easy, you should use TCP::payload to capture the whole payload field and try to collect whatever bytes you would need from this field.

    REF - https://clouddocs.f5.com/api/irules/TCP__payload.html

     

    Regards,

    Dario.

     

Dario_Garrido's avatar
Dario_Garrido
Icon for MVP rankMVP
Aug 21, 2020

Hello JCaine.

 

Request-logging is only for HTTP traffic. If non-HTTP is your scenario, then forget the request-logging solution.

REF - https://support.f5.com/csp/article/K00847516

 

In you case the only solution is to use iRules (better with HSL than Remote logging)

 

F5 profiles work as OSI layer parsers. If you have an TCP VS, only TCP headers will be parsed (you are able to use any TCP::xxx command). If you assign an HTTP to this VS, app header will be also parsed (and you will be able to use HTTP::xxx commands), the same for any other profile: TLS, SMTP, DCHP.

 

What if you have a custom protocol which runs over TCP? Easy, you should use TCP::payload to capture the whole payload field and try to collect whatever bytes you would need from this field.

REF - https://clouddocs.f5.com/api/irules/TCP__payload.html

 

Regards,

Dario.