<< Click to Display Table of Contents >> Navigation:  Event and Object Analysis > Capture Results Filtering > Prefiltering HTTP Requests > Conditions > URL Condition

Checks the URL value of a HTTP request.

Description

This condition checks if the URL value of the HTTP request contains a substring or matches a wildcard pattern/regular expression.

Please keep in mind, that the entire URL of the request is checked, i.e. http://www.server.com/script-or-page-path.htm.

Warning!
If you need to check only the host name, use the "HEADER" condition. This will speed up the check and save the resources.

Format

<c name="url" op="..." value="..." />

The "name" attribute:

The name attribute specifies the name of the condition - name="url".

The "op" attribute:

The op="..." attribute specifies the type of comparison. Possible values:

eq or = or ==

True if the header value CONTAINS the specified value

ne or != or <>

True if the header value DOES NOT CONTAIN the specified value

wc or wildcard

True if the header value matches the specified wildcard pattern

re or regex or regexp

True if the header value matches the specified regular expression

The value attribute:

The value="..." attribute specifies the value to search for (a string, a wildcard or a regular expression).

Example

<c name="url" op="eq" value="game" />

True if the URL contains the substring "game".

<c name="url" op="wc" value="http://*.mail.ru/*send*" />

True if the URL matches the wildcard pattern "http://*.mail.ru/*send*".

<c name="url" op="re" value="satan|shopping|dating|movies|hexogen" />

True if the URL matches the following regular expression: "satan|shopping|dating|movies|hexogen".

Example

Detect requests with bad words (satan|shopping|dating|movies|hexogen), mark them with the shopping tag. Ignore requests marked as shopping.

<?xml version="1.0" encoding="utf-8"?>
<filter name="HTTP filter" version="1.0">
 <comment>HTTP filter.</comment>
 <table name="main">
 
   <rule enabled="1">
     <comment>
       Detect requests possibly related to bad content.
     </comment>
     <match>
       <c name="url"
          op="re"
          value="satan|shopping|dating|movies|hexogen" />
     </match>
     <action name="tag" value="shopping"/>
   </rule>
 
   <rule enabled="1">
     <comment>
       Ignore requests tagged as "shopping".
     </comment>
     <match>
       <c name="tag" tag="shopping"/>
     </match>
     <action name="drop" />
   </rule>
 
   <rule enabled="1">
     <action name="accept" />
   </rule>
 </table>
</filter>