Forum Discussion
rshetty_242152
Nimbostratus
@Kevin Stewart I tried to use the rule which you mentioned. I was unable to get the content type as 22 in the payload. Not sure why. I extracted all the bytes from the payload nothing made sense to me. Here is what it logs: Type == 72 84 84 80 47 49 46 49 32 50 48 ..... 125 125
Here is the part of the rule modified:
when SERVER_DATA {
binary scan [TCP::payload] c* type log local0. "Type == $type "
Kevin_Stewart
Apr 17, 2018Employee
Right, but the iRule can't work if the traffic isn't encrypted.