# Weird TCP messages coming into my flow

**URL:** <https://discourse.nodered.org/t/weird-tcp-messages-coming-into-my-flow/69073>\
**Category:** General\
**Created:** [15 October 2022 16:26 UTC](https://discourse.nodered.org/t/weird-tcp-messages-coming-into-my-flow/69073 "2022-10-15T16:26:43Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![ifiififiifiif](https://avatars.discourse-cdn.com/v4/letter/i/74df32/32.png) [@ifiififiifiif](https://discourse.nodered.org/u/ifiififiifiif)\
**Post date:** [15 October 2022 16:26 UTC](https://discourse.nodered.org/t/weird-tcp-messages-coming-into-my-flow/69073/1 "2022-10-15T16:26:43Z")

</div>

Hi. Thanks for reading my post. I'm having great luck as a newbie with node-red overall for a project that I'm working on. The one thing I can't seem to figure out is a strange message that comes every now and then from the open TCP port. I'm using custom hardware to send TCP messages, a twelve character string. I've added a function node to try to filter out any of the other messages:

```auto
var data = msg.payload;
var len = msg.payload.length;
if (len === 12) {
    msg.payload = data;
    return msg;
}

```

It only passes the valid messages intermittently. I am wondering if I have messed up the syntax. Any help would be greatly appreciated. Thank you again for reading.

---

<div class="post-metadata">

**Author:** ![ifiififiifiif](https://avatars.discourse-cdn.com/v4/letter/i/74df32/32.png) [@ifiififiifiif](https://discourse.nodered.org/u/ifiififiifiif)\
**Post date:** [15 October 2022 16:28 UTC](https://discourse.nodered.org/t/weird-tcp-messages-coming-into-my-flow/69073/2 "2022-10-15T16:28:36Z")

</div>

Also the strange messages coming in look like this:

```auto
GET / HTTP/1.1

Host: 161.35.101.114:49153

Connection: close

Accept-Encoding: gzip

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36

```

---

<div class="post-metadata">

**Author:** ![marcus-j-davies](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/marcus-j-davies/32/103435_2.png) [@marcus-j-davies](https://discourse.nodered.org/u/marcus-j-davies)\
**Post date:** [15 October 2022 19:43 UTC](https://discourse.nodered.org/t/weird-tcp-messages-coming-into-my-flow/69073/3 "2022-10-15T19:43:42Z")

</div>

Hi @ifiififiifiif

Welcome to the forums!

This is not a "strange" TCP Message per se 😅  
This is a browser request.

if I navigate to [https://duckduckgo.com](https://duckduckgo.com)  
The server @ [duckduckgo.com](http://duckduckgo.com) will receive something very simular.

According to the user agent, the following browser is accessing this resource.  
**Chrome 50 on Mac OS X.**

if you have accessed this TCP server through the mentioned browser at some point, its likely trying to ascertain some info about it to help with its "recent" viewed websites or something to that effect.

What you are seeing, is the RAW TCP request sent by a web browser.  
The browser will likely freakout, as its expecting a valid HTTP/1.1 response.

In a nut hell: The above browser is accessing [http://161.35.101.114:49153/](http://161.35.101.114:49153/)

**Host** : 161.35.101.114:49153  
**URI** : /  
**Method** : GET

---

<div class="post-metadata">

**Author:** ![ifiififiifiif](https://avatars.discourse-cdn.com/v4/letter/i/74df32/32.png) [@ifiififiifiif](https://discourse.nodered.org/u/ifiififiifiif)\
**Post date:** [15 October 2022 20:31 UTC](https://discourse.nodered.org/t/weird-tcp-messages-coming-into-my-flow/69073/4 "2022-10-15T20:31:44Z")

</div>

Sure I get that. But this is not a standard HTTP port so they’re crawlers. It sort of doesn’t matter what they are or why they are I just need to figure out how to filter them out. I’m using two ports for TCP and they both get messages from crawlers. It seems to be happening more and more often. Any thoughts on why this function mode isn’t working consistently? Any ideas on a general method of filtering out messages from crawlers? Thanks.

---

<div class="post-metadata">

**Author:** ![marcus-j-davies](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/marcus-j-davies/32/103435_2.png) [@marcus-j-davies](https://discourse.nodered.org/u/marcus-j-davies)\
**Post date:** [15 October 2022 20:46 UTC](https://discourse.nodered.org/t/weird-tcp-messages-coming-into-my-flow/69073/5 "2022-10-15T20:46:45Z")

</div>

Ahh I see.

On the basis you should not be receiving HTTP requests.  
If your TCP IN node is set to output a string.

In a function node connected to the output of the TCP IN node...

```auto
const Blocked = ["GET","POST"]
const Header = msg.payload.substring(0, 4).trim().toUpperCase()

if(!Blocked.includes(Header)){
   return msg
}

```

if outputting a `buffer` it should be just as trivial.  
just check the first 4 bytes for a pattern.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [14 December 2022 20:47 UTC](https://discourse.nodered.org/t/weird-tcp-messages-coming-into-my-flow/69073/6 "2022-12-14T20:47:31Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.