Forum Discussion
What_Lies_Bene1
Dec 14, 2012Cirrostratus
You can only combine them in the HTTP event;
when HTTP_REQUEST {
if { (([HTTP::path] starts_with "/tulip/") && ([IP::addr [IP::client_addr] equals 10.0.0.0/8])) } {
persist cookie
}
else {
persist source_addr
}
}