STREAM::replace

Description

Specifies a string to replace the currently-matched data-stream octets. This command overrides any replacement value set in the Stream Profile or in a STREAM::expression match/replacement set. This command is not sticky; it applies only once to the current match.
The string consists of Unicode characters and will be encoded in UTF-8 before it is inserted into the data stream (at the point from which the matched octets are removed) so the number of replacement octets may exceed the number of characters in the string. For example, if the replacement string is just one currency symbol
"¤"

or

"\u00a4"

then two octets

0xC2 0xA4
will be inserted into the data stream.
If you invoke this command without a replacement-string argument, the data-stream will not be altered (i.e., no replacement will occur for this particular match).

Syntax

STREAM::replace [<replacement>]

STREAM::replace [<replacement>]

  • Specifies a Unicode string to replace the currently-matched data-stream octets, overriding any replacement value set in the Stream Profile or in a STREAM::expression match/replacement set. This command is not sticky; it applies only once to the current match. If <replacement> is omitted, no replacement is performed (the matched octets will remain the data stream).

Note that the string will be encoded in UTF-8 when it is inserted into the data stream, which may add more octets to the data stream than there are characters in the string.
If you supply a TCL binary string as the argument it will be converted to Unicode by the method of STREAM::encoding ascii (even though it is not taken from the application data stream) and then encoded in UTF-8. (Sorry.)

Examples

when STREAM_MATCHED {
    set server [string tolower [STREAM::match]]
    if {$server contains "mail"} {
        STREAM::replace "webmail.yourdomain.com/$mailhost"
    }
}

Events