To match the host name www.example.com in all HTTP requests, which expression is correct?

To match the host name www.example.com in all HTTP requests, which expression is correct?

• A. HTTP.REQ.HOSTNAME.EQ("www.example.com")
• B. HTTP.RES.HOSTNAME.EQ("www.example.com")
• C. HTTP.REQ.HOSTNAME.("example.com")
• D. HTTP.RES.HOSTNAME.CONTAINS("www.example.com")

Answer: (A)

Matching the host header of incoming HTTP requests is done by inspecting the request, not the response, and comparing it to the exact hostname. The expression HTTP.REQ.HOSTNAME.EQ("www.example.com") does just that: it checks the hostname in each incoming HTTP request and returns true only when it equals www.example.com, making it the correct way to match that host across all requests. Using the response (HTTP.RES...) would test the hostname in replies, which isn’t present for incoming requests, so it won’t match the requests you’re filtering. The other option uses invalid syntax for the hostname comparison, and the last option also checks the response rather than the request.

Matching the host header of incoming HTTP requests is done by inspecting the request, not the response, and comparing it to the exact hostname. The expression HTTP.REQ.HOSTNAME.EQ("www.example.com") does just that: it checks the hostname in each incoming HTTP request and returns true only when it equals www.example.com, making it the correct way to match that host across all requests.

Using the response (HTTP.RES...) would test the hostname in replies, which isn’t present for incoming requests, so it won’t match the requests you’re filtering. The other option uses invalid syntax for the hostname comparison, and the last option also checks the response rather than the request.