For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

VernonWells's avatar
VernonWells
Icon for Employee rankEmployee
Apr 17, 2016

Firstly, your initial assumptions are correct. In the client-side context (either in CLIENT_ACCEPTED or inside the 

clientside
command above) a call to 
TCP::collect
triggers collection of segments on the client-side of the connection, firing CLIENT_DATA when some amount of data are collected (although it may fall on segment boundaries, there is no guarantee of that). Similarly, in the server-side context (in SERVER_CONNECTED above), a call to 
TCP::collect
triggers collection of segments on the server-side of the connection, firing SERVER_DATA when some amount of data are collected.

The rule above appears to be for SMTPS. Note that the first message in SMTP is sent from server to client, not the other way around. That's probably why 

TCP::collect
for the clientside is not invoked until after the first message is received on the serverside. One doesn't expect a clientside message until after the first serverside message is delivered to the client.