TCP Info Logging

TCP::collect gets the raw bytes that are sent. The data collected will be available in the CLIENT_DATA event.

For example:

when CLIENT_ACCEPTED {
TCP::collect 16
}
when CLIENT_DATA {
 For logging in other events
set cli "[IP::client_addr]:[TCP::remote_port]"
set dataVal [TCP::payload]
binary scan $dataVal H16 hexRep
log local0. "TCP connection ($cli) sent: $hexRep"
}

When the client connects this will cause (at least) 16 bytes to be collected. It then converts that data to a hex representation and logs it.