regsub failing

I just tested this out and it works for me. Here are the approaches I would take if I were you:

 

 

1. If all you are doing is replacing all occurances of ":8088" with an empty string, I'd use the Stream profile (if it's available to you).

 

 

2. Add some logging to your rule to determine if it's the regsub that's not working or the the HTTP::payload replace.

 

 

3. Change your code to do a regexp with the -indices option to return the indices of the matched sections. Then do individual HTTP::payload replaces for each of those indices. This avoids having to make a copy of the entire reponse payload. Search the forums for the indices option of regexp for more info.

 

 

-Joe