This message was deleted.
# citrix-netscalers
Slackbot
10/02/2019, 5:34 PMThis message was deleted.
m
Mads Petersen
10/02/2019, 6:28 PMI've only need to do content switching based on domain quries, so havn't tried using the opcode, but doesn't the OpCodes only go from 0 to 15? so the only valid expression there would be .EQ(5) aka update.
Could you do a packet capture and see the request?
👍 1
b
BobFrankly
10/02/2019, 6:42 PMyeah, it shows as a 5, Dynamic Update, 0101
BobFrankly
10/02/2019, 6:42 PMtried matching on all of those an getting nothing
m
Mads Petersen
10/02/2019, 6:42 PMIs that the full content? Then you can't use 5
b
BobFrankly
10/02/2019, 6:42 PMit's the different views in wireshark
m
Mads Petersen
10/02/2019, 6:43 PMtry .CONTAINS() instead?
BobFrankly
10/02/2019, 6:43 PMaccording to this, it should be "QUERY" straight up.
BobFrankly
10/02/2019, 6:43 PMbut that doesn't work either
m
Mads Petersen
10/02/2019, 6:43 PMb
BobFrankly
10/02/2019, 6:44 PMalso, contains isn't a valid expression there
m
Mads Petersen
10/02/2019, 6:44 PMyeah i just saw
b
BobFrankly
10/02/2019, 6:44 PMyeah, I was looking at the RFC reference as well
BobFrankly
10/02/2019, 6:45 PM0101 is the 4 bit binary representation of the UPDATE opcode, was hopeful that would match.
BobFrankly
10/02/2019, 6:45 PMI'm leaning towards "Citrix needs to fix this"
m
Mads Petersen
10/02/2019, 6:46 PMYeah maybe, sadly i don't have time to setup a test myself right now, got some azure sdwan issues.
j
Jonathan
10/02/2019, 11:18 PMdid you try .EQ(UPDATE) ?
b
BobFrankly
10/03/2019, 2:41 PMyup. No match