OPERATIONAL DEFECT DATABASE
...
...
When generating a web scraping attack of session opening anomaly type, there is an attack start/end event shown in the /var/log/asm and GUI: Security :: Event Logs : Application : Web Scraping Statistics. The event has a "source ip" field which should come along with the route domain. In the case of "session opening anomaly" the route domain is always zero. (For example: 127.0.0.1%0). Even there is a non-zero route domain configured.
Incorrect route domain field is shown in the GUI and /var/log/asm.
Route domain is configured and a web scraping attack event triggers.
None. This is a cosmetic error. The system uses the correct route domain
The fix is to set the correct route domain for the "session opening anomaly" events shown in the GUI and /var/log/asm
Click on a version to see all relevant bugs
F5 Integration
Learn more about where this data comes from
Bug Scrub Advisor
Streamline upgrades with automated vendor bug scrubs
BugZero Enterprise
Wish you caught this bug sooner? Get proactive today.
