Rewriting X-Forwarded-For ip address
The 30 Minute Regex Tutorial The code project
2. Deny and error handling
3.1. Learning data
3.1.1. Applications learned
Applications learned is shown as a 3-level expandable table. Group, URL path and details.
Applications learned
Expandable: Click + to expand.
Application group (level 1)
Applications are divided into groups based on path characteristics. The group name reflects the characteristics of the group. The most Expands 2 levels.
common grouping criteria is the file extension. But also the appear- ance of special characters like '$' or '.' in the path is used as grouping criteria.
Applications URL paths (level 2)
When a group is expanded the URL paths in that group is listed. Each URL path is an application learned. Note that this list also contains "simple" applications, applications that only takes global parameters as input, and therefore potentially can be very long.
Application details (level 3)
When an application URL path is expanded the details learned about that specific application is shown. Number of unique URL Paths in the group.
Paths
Applies to: Group level (1).
Number of parameters the application takes as input.
If a blue number in parentheses is shown at the left of the number this number indicates how many of the parameters learned that are approved based on the Learner thresholds which are configurable.
Parameters that does not exceed one or more threshold values are colored blue while trusted parameters name are black.
Applies to: URL path level (2).
Name of input validation class mapped to a parameter.
Class
If the parameter is not trusted yet, the class name is blue. Applies to: Detail level (3).
Number of unique IP-addresses requesting the resource.
Source
Applies to: Group (1), URL path (2) and Detail level (3). Number of unique timestamps in requests for the resource.
Time
Applies to: Group (1), URL path (2) and Detail level (3).
Time difference between the first and last observed request for the re- source.
Time (delta time)
Applies to: Group (1), URL path (2) and Detail level (3).
3.1.1.1. Deleting applications or corresponding parameters
To delete a learned application or a corresponding parameter expand to the level desired and click the red X.
3.1.2. Global parameters learned
The Global parameters learned section shows all parameters observed on a number of paths that exceeds the Learner setting Global parameters Path duplication threshold.
Note that the list also includes observed parameter names which are still pending approval based on the Learner threshold settings. The number of approved, or trusted, observations is indicated with black number while a blue number shows the number of non-approved observations.
Group, URL path and details.
Global parameters
Expandable: Click + to expand.
Parameter name (level 1) Name of the parameter Expands 1 level.
Applications URL paths (level 2)
When Global parameter is expanded a list of URL paths which are observed taking the parameter as input is shown.
Name of input validation class mapped to a parameter.
Class
Applies to: Parameter name level (1).
Number of unique URL Paths observed using the parameter.
Paths
Applies to: Parameter name level (1).
Number of unique URl Paths using the parameter but where the para- meter name is not approved yet - where threshold values is not reached yet.
Applies to: Parameter name level (1).
Number of unique URl Paths using the parameter where the parameter name is approved - where threshold values is reached.
Trusted
Applies to: Parameter name level (1).
3.1.3. Static content learned
This section shows all URL Paths to static resources learned. URL Paths are grouped by their extension.
Extension and URL Paths learned.
Static content learned
Expandable: Click + to expand.
Extension (level 1)
The static content policy is based on allowing extension and URL Path based on characters in the URl path.
Expands 1 level.
To be included in the static content policy, static resources must therefore have a file extension. A case where natural URLs are pointing to static content is handled by the Learner by building Global URL policies.
Static content URL paths (level 2)
When an extension is expanded the URL paths in that extension group is listed.
Number of unique URL Paths in the extension group.
Paths
Applies to: Extension level (1).
Number of unique IP-addresses requesting the resource.
Source
Applies to: Extension (1) and URL path level (2).
Number of unique timestamps in requests for the resource.
Time
Applies to: Extension (1) and URL path level (2).
Time difference between the first and last observed request for the re- source.
Time (delta time)
Applies to: Extension (1) and URL path level (2).
3.1.3.1. Deleting static content extensions
To delete a static content extension (a group) click the red X in the list.
3.1.4. Tools
This contains tools for tidying the learning data set.
Delete learned parameter names using simple wildcard matching.
Delete querys by name wildcard
Input field
Valid input
A string or a simple wildcard.
Use the following characters to specify wildcards:
? = one ocurrence of any character.
Input example
http://* - matches all querys (parameter names) beginning with
http:// Default value
<none>
Preview displays parameter names matching the wildcard below the input field.
Delete performs deletion of parameters matching wildcard. Delete learned parameter names using matching occurrence data.
Delete querys by data
Input field
Source
Number of IP addresses requesting the resource. Valid input
number in range 0 -
Input example
10 - Querys requested by 10 or less IP addresses.
Default value
<none>
Time
Number of unique timestamps in requests for the resource. Valid input
number in range 0 -
Input example
10 - Querys requested in a maximum of 10 intervals of 1 second.
Default value
<none>
Time (delta time)
Time difference between the first and last recorded request for the re- source.
Valid input
Time interval specified in seconds.
number in range 0 -
Input example
86400 - Querys with a recorded difference between first and last re-
Default value
<none>
Preview displays parameter names matching search criteria below the input fields.
Delete performs deletion of parameters matching search criteria.
3.1.5. Lower button bar
The lower button bar contains the following buttons.
To see the effect of deleting selected learning data in the resulting policy section click this button. Wait a few seconds and reload the page.
Re-analyze data
Button
Use with caution!
Reset learn data
Button When clicking this button and accepting the confirm pop-up window. All learning data for that proxy will be deleted!
If learning is enabled the learning and data sampling process will start from scratch.