Forum Discussion
Oct 26, 2004
You are very close. Let's take a look at your code piece by piece...
when CLIENT_ACCEPTED {
if {[TCP::local_port] == 80} {
TCP::collect 75
log local0. "Text1[findstr [TCP::payload] "user=" 5]End"
}
}
The CLIENT_ACCEPTED event is triggered when the client establishes a connection. At this point there is no data to be processed (we'll there could be but it is not guaranteed). You must call TCP::collect which you are doing for 75 bytes. The resulting payload is not available until the CLIENT_DATA event is triggered. This will occur when the 75 bytes have been received (or portion of if the size is smaller than 75). At this point you will have access to the TCP::payload data.
when CLIENT_DATA {
log local0. "Text1[findstr [TCP::payload] "user=" 5]End"
if {[findstr [TCP::payload] "user=" 5] == "me"} {
pool pool1
}
else {
pool pool2
}
}
Note that if you need additional data, you can call TCP::collect from within the CLIENT_DATA event and that will trigger a subsequent CLIENT_DATA event when the additional data is called. When you access TCP::payload at this point, the content will be the total accumulated payload.
Hope this helps.
-Joe