You can configure various expressions for working with text that flows through the NetScaler appliance. Following are some examples of how you can parse text by using a default syntax expression:
For example, you may want to identify HTTP requests that contains a particular Accept-Language header for the purpose of directing the request to a particular server.
For example, you may want to block requests for particular URLs. Note that the string can occur at the beginning, middle, or end of another string.
For example, you may want to identify all POST requests that are directed to a database application for the purpose of refreshing cached application data.
Note that there are specialized tools for viewing the data stream for HTTP requests and responses. For example, from the following URL, you can download a Firefox Web browser plug-in that displays HTTP request and response headers:
The following plug-in displays headers, query strings, POST data, and other information:
After you download these plug-ins, they are accessible from the Firefox Tools menu.
A text-based expression consists of at least one prefix to identify an element of data and usually (although not always) an operation on that prefix. Text-based operations can apply to any part of a request or a response. Basic operations on text include various types of string matches.
For example, the following expression compares a header value with a string:
Following expressions are examples of matching a file type in a request:
In the preceding examples, the contains operator permits a partial match and the eq operator looks for an exact match.
Other operations are available to format the string before evaluating it. For example, you can use text operations to strip out quotes and white spaces, to convert the string to all lowercase, or to concatenate strings.
You can apply various operators to combine text prefixes or expressions. For example, the following expression concatenates the returned values of each prefix:
http.req.hostname + http.req.url
Following is an example of a compound text expression that uses a logical AND. Both components of this expression must be TRUE for a request to match the expression:
http.req.method.eq(post) && http.req.body(1024).startswith("destination=")
The primary categories of text expressions that you can configure are:
For more information, see "Expression Prefixes for Text in HTTP Requests and Responses."
For more information, see "Expression Prefixes for VPNs and Clientless VPNs."
For more information about TCP payload expressions, see "Default Syntax Expressions: Parsing HTTP, TCP, and UDP Data."
For information about text expressions for SSL and SSL certificate data, see "Default Syntax Expressions: Parsing SSL Certificates" and "Expressions for SSL Certificate Dates."
From a performance standpoint, it typically is best to use protocol-aware functions in an expression. For example, the following expression makes use of a protocol-aware function:
The previous expression performs better than the following equivalent expression, which is based on string parsing:
In the first case, the expression looks specifically at the URL query. In the second case, the expression scans the data for the first occurrence of a question mark.
There is also a performance benefit from structured parsing of text, as in the following expression:
(For more information on typecasting, see "Typecasting Data.") The typecasting expression, which collects comma-delimited data and structures it into a list, typically would perform better than the following unstructured equivalent:
Finally, unstructured text expressions typically have better performance than regular expressions. For example, the following is an unstructured text expression:
The previous expression would generally provide better performance than the following equivalent, which uses a regular expression:
For more information on regular expressions, see "Regular Expressions."