Hi Kevin & Nitass,,many thanks for helping me with disabling pipelining idea. But I still need to ensure the behavior.
You said that "when pipelining is disabled, bigip will terminate a connection after responding 1st request". Does this mean bigip will close the socket created before to handle the first request? Or does it mean that bigip simply ignore the subsequent request in which delimited with "\r\n" character?
Let me add more info regarding my case. So there was HTTP pipeline request that is suspected being used for this purpose:
1. The first request is the legitimate HTTP request, in which requesting the web page that the client truly want to visit
2. The second request (or the third, fourth, and so forth if exist) is used to trick the DPI system, in which read for certain pattern and in fact cannot detect if pipeline is being used.
So the bigip is located behind the DPI system on the client perspective.
That is why I need the bigip to detect if the request is in pipeline form or not, and reject the request totally (first and subsequent) if so.
But I cannot implement the CLIENT_ACCEPTED and CLIENT_DATA event as you suggest, since the same VS used currently need to run another HTTP inspection using HTTP_REQUEST event.
I will also test the disable pipelining on my network and let you know if the behavior meets my expectation.
Thanks again :)