Aaron
Thanks for the assist. One last question if anyone can explain.
Aarons Reply
Note, I'm assuming you only want to check the last IP in the XFF header value. You could also loop through each IP and check it against the class. But then you'd be checking more than your proxy's XFF value.
Aaron
Im actually trying to get the first value in the XFF. I have tried several things that I thought would work. How do I get the first value of the XFF
Get the last comma separated value from the XFF header
set xff [lindex $xff [expr {[llength $xff]} - 1]]
Out of all the rules that I have done I thought this one would be cake.
It is still eluding me.