Forum Discussion
IheartF5_45022
Nov 06, 2013Nacreous
For the IP blocking you would need to check IP::client_addr (this code with switch not tested BTW
switch -glob [IP:addr [IP::client_addr]] {
"1.1.*" -
"2.2.*" -
"3.3." {
reject
}
}
For the XML - try here
Alternatively you would have to HTTP::collect and then use the HTTP_REQUEST_DATA event to search the body for the offending data.
Not sure if anyone is feeling more generous and wants to provide a full rule for you?