Which host group does a request without a Host Header fall into?

Short answer

In a request without a Host header, WAF uses the target IP:port value the request came to (the address and port the vService listens on, e.g. 203.0.113.10:443) instead of Host, and compares this value with the same patterns, in the same order, as the other requests (Virtual Host Groups). If the pattern of no named group fits this value, the request falls into the default group (Default Host Group); this is the typical case. If the pattern in the Virtual Host Patterns field of a group is exactly 203.0.113.10:443 or covers this value with *, the request falls into that group; in this way, requests without a Host header can be gathered in a separate group. The request is inspected in the mode and with the rules of the group it falls into; it does not pass uninspected. Requests without a Host header mostly come from HTTP/1.0 clients and some automation tools. The group the request fell into appears in the Host Group information of the WAF Event Logs record.

How Does It Work?

Situation	Which group the request falls into
The pattern of no group fits the target IP:port value	The default group (What is the default host group?)
The pattern of a group is 203.0.113.10:443	That group
The pattern of a group covers the target IP:port value with * (e.g. 203.0.113.10*)	That group; if more than one group fits, the one created first

The evaluation order is the same as for requests with a Host header: the named groups are tried in the order of creation, and the first group that fits wins (Which host group does a request fall into; what if it matches none?).

Gathering Requests Without Host in a Separate Group in TR7

1. In the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab, the new group window is opened with the icon at the top right of the Virtual Host Groups band (How is a Host Group added; what goes into the Virtual Host Patterns field?).
2. A name is written in the Virtual Host Group Name field (e.g. no-host) and WAF Mode is selected; in the Virtual Host Patterns field, the address and port the vService listens on are written together (e.g. 203.0.113.10:443). If the vService listens on more than one address or port, a separate pattern is added for each of them.
3. Add is clicked.

When the pattern is written as a full IP:port, requests whose Host header is exactly 203.0.113.10:443 (requests made directly with the IP and port) also fall into this group. Wide patterns such as *:443 also cover requests whose Host header is example.com:443; to gather requests without Host, a full IP:port pattern is used. Since * is accepted only at the beginning (*.) in WEB-CLI, patterns such as 203.0.113.10* can be entered only from the interface.

Common Misconceptions

• "A request without a Host header always falls into the default group." If there is a group with a pattern that fits the target IP:port value, it falls into that group.
• "A request without a Host header does not pass through WAF." It is inspected in the mode and with the rules of the group it falls into.
• "An IP address pattern alone is enough." The comparison is made with the whole IP:port value; the 203.0.113.10 pattern does not fit the 203.0.113.10:443 value.

How it is done in the documentation

• WAF · Terminology
• WAF Mode · Virtual Host Patterns
• Virtual Host Groups · Add (which group a request falls into)

Related questions

• Which host group does a request fall into; what if it matches none?
• What is the default host group?
• Which stages does a request go through inside TR7 WAF?