Filtering TCP packets using a TAG not working properly...

Hi David,

you can access each single TCP packet by using a combination of [TCP::collect] (collect a single TCP packet), [TCP::payload] (access the captured packet data) and [TCP::release] (send the captured packet on the wire) commands.

You could also [LB::detach] an existing serverside connection on each arived packet and then make a new routing decission using the [pool] or [node] command.

An example code would look like this...

when CLIENT_ACCEPTED {
    set default_pool [LB::server pool]
    set last_pool ""
    TCP::collect
}
when CLIENT_DATA {
    if { [TCP::payload] contains "\[activedirectory\]" } then {
        set new_pool YOUR_SYSLOG_POOL_1
    } elseif { [TCP::payload] contains "\[proxy\]" } then {
        set new_pool YOUR_SYSLOG_POOL_2
    } elseif { [TCP::payload] contains "\[firewall\]" } then {
        set new_pool YOUR_SYSLOG_POOL_3
    } else {
        set new_pool $default_pool
    }
    if { $new_pool ne $last_pool } then {
        set last_pool $new_pool 
        LB::detach
        pool $new_pool
        TCP::release
        TCP::collect
    } else {
        TCP::release
        TCP::collect
    }
}

Cheers, Kai