Forum Discussion

Patti_G_72768's avatar
Patti_G_72768
Icon for Nimbostratus rankNimbostratus
Oct 31, 2013

Need help with iRule to detect LOIC/HOIC client

Hi all, the latest rule I'm working on is supposed to detect a LOIC/HOIC client. The rule is supposed to look for the following in the uri query string (not case sensitive): 1) "msg" 2) "id" 3) rando...
application delivery
devops
iRules
What_Lies_Bene1's avatar
What_Lies_Bene1
Icon for Cirrostratus rankCirrostratus
Oct 31, 2013

I'd reduce it to this;

when HTTP_REQUEST {
 set requri [string tolower [HTTP::query]]
 if { ($requri contains "id") && ($requri contains "msg") } {
  log local0. "Detected LOIC/HOIC client request based on query string."
  reject
 }
}

I'm not quite sure about the regex, is there any value in searching for a random six character value? Wouldn't any part of a valid query match? If so, where is it in the query string?