Cisco Systems 2.5 HTTP Response Body, HTTP Response Status Line

37-19
Cisco Router and Security Device Manager 2.5 User’s Guide
OL-4015-12
Chapter37 Cisco Common Classifi cation Policy Language
Class Maps
Match Field
Check this box the class map to match the field type that you chose.
HTTP Response Body
Specify the HTTP response body criteria to inspect for.
Java Applets in HTTP Response
Check this box to inspect for Java applets in the HTTP response.
Length
Check this box and choose Greater than (>) to specify an upper limit to the
response body length. Choose Less than (<) to specify a lower limit.
Regular Expressions
Click this box to specify regular expressions to be matched against. Choose an
existing regular expression class map, or create a new one that will match the
strings you are inspecting for. See Add or Edit Regular Expression for more
information on how to create regular expressions. To examine an existing map
without leaving this dialog, choose it in the Select an existing map list, and click
View.
HTTP Response Status Line
Click this box and specify regular expressions to be matched against response
status lines. Choose an existing regular expression class map, or create a new one
that will match the strings you are inspecting for.
Sample Use Case
Configure the router to log an alarm whenever an attempt is made to access a
forbidden page. A forbidden page usually contains a 403 st atus-code and the
status line looks like “HTTP/1.0 403 page forbidden\r\n.”
The regular expression for this is the following:
[Hh][Tt][Tt][Pp][/][0-9][.][0-9][ \t]+403