Quering LDAP AUTH information

You'd do this by using the TCP::collect command and the TCP::payload variable to determine whether or not the desired information is present.

 

 

Here's a good example: Click here

 

 

Hope this helps,

 

-Colin