How to determine TCP::payload replace offset value

Hello,

 

I am looking to use TCP::payload replace to change a server response but need assistance with figuring out how to determine the offset. There is a preamble before the string I need to replace and I need to maintain that. Here's what I have so far:

 

when SERVER_CONNECTED {

 

TCP::collect

 

}

 

when SERVER_DATA {

 

set sdata [TCP::payload]

 

if { $sdata contains "foo.bar.com:8080" } {

 

log local0. "sdata found: $sdata"

 

TCP::payload replace 0 [string length $sdata] "widget.com:8080"

 

}

 

TCP::release

 

TCP::collect

 

}

 

Of course the '0' in 'TCP::payload replace 0' will start the replacement at the beginning of the server data response which does not work.

 

How would I determine where in the server data response 'foo.bar.com:8080' starts, which is what I believe the offset value is for?