Forum Discussion
Feb 18, 2019
It's the following.
log local0. [TCP::payload]
this gives username@ftp1
regexp "USER \(\[a-zA-Z0-9_-]+)" [TCP::payload] all user
log local0. "$user"
this gives username
It's the following.
log local0. [TCP::payload]
this gives username@ftp1
regexp "USER \(\[a-zA-Z0-9_-]+)" [TCP::payload] all user
log local0. "$user"
this gives username