Forum Discussion
hooleylist
Dec 20, 2011Cirrostratus
Mike's suggestion was along the lines of what I was thinking. If you use a datagroup make sure to remove the $:: prefix from the datagroup name in the iRule.
If you want to use a single ASM policy, I think you could put Web Scraping in transparent mode and manually send a block message using HTTP::respond in the ASM_REQUEST_VIOLATION event:
http://devcentral.f5.com/wiki/iRules.ASM_REQUEST_VIOLATION.ashx
You'd want to check ASM::violation_data to see if web scraping was detected:
http://devcentral.f5.com/wiki/iRules.ASM__violation_data.ashx
Aaron