Chapter 6 Advanced Expressions: Parsing HTTP, TCP, and UDP Data 129
Expressions for Extracting Segments of URLs
You can extract URLs and portions of URLs, such as the host name, or a segment
of the URL path. For example, the following expression identifies HTTP requests
for image files by extracting image file suffixes from the URL:
http.req.url.suffix.eq("jpeg") || http.req.url.suffix.eq("gif")
Most expressions for URLs operate on text and are described in “Expression
Prefixes for Text in HTTP Requests and Responses,” on page 67. This section
discusses the GET operation. The GET operation extracts text when used with the
following prefixes:
HTTP.REQ.URL.PATH
VPN.BASEURL.PATH
VPN.CLIENTLESS_BASEURL.PATH
Cache-Control header.
MAX_AGE Returns the value of the Cache-Control header Max-
Age. If this header is absent or invalid, 0 is returned.
Following is an example:
http.req.cache_control.max_age.le(3)
Cache-Control header.
MAX_STALE Returns the value of the Cache-Control header Max-
Stale. If this header is absent or invalid, 0 is returned.
Following is an example:
http.req.cache_control.max_stale.le(3)
Cache-Control header.
MIN_FRESH Returns the value of the Cache-Control header Min-
Fresh. If this header is absent or invalid, 0 is returned.
Following is an example:
http.req.cache_control.min_fresh.le(3)
Cache-Control header.S_
MAXAGE Returns the value of the Cache-Control header S-
Maxage. If this header is absent or invalid, 0 is returned.
Following is an example:
http.req.cache_control.s_maxage.eq(2)
Operations That Evaluate Cache-Control Headers
HTTP Header Operation Description