Forum Discussion
Matt_Williamson
Nimbostratus
NimbostratusiRule to persist on tcp_content
Hi all, I'm trying to write a rule that will search the first 2500 bytes of tcp_content for the "USERNAME=" string and then persist on the next 7 characters after that. Here is my original attempt. ...
In the particular example above, you do not need the TCP::release because there is an implied release if a new collect was not issued in the CLIENT_DATA event. However, doing the TCP::release is certainly not harmful in any way.
Anybody going to take a crack at cleaning up Vinny's rule? He did at least hack something together...
Some hints:
A) You probably only want to do the TCP::collect 250 once in the SERVER_CONNECTED event (you can then get rid of all the TCP::collect's in the SERVER_DATA event).
B) Don't use TCP::respond here as it will provide a response to the server. What you will want to do is use:
TCP::payload replace
