Best Bot Firewall Setting

[sdayman]

Most of this has already been covered. Either in the threads @fritex linked to, or this one which is very similar to yours:

Block all "bot" happy with the result but still one can bypass

I have this rule which is supposed to block all agent with “bot” (http.user_agent contains “bot” and (ip.geoip.asnum ne 15169 and http.user_agent ne “Googlebot/2.1”) and (not http.user_agent contains “compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm”)) I still see this bypassing the rule Mozilla/5.0 (compatible; Riverbot/1.0; +http://www.useriver.com/bot.html) Did I miss something in the rule ?