Forum Discussion
jdscrymgeour_42
Nimbostratus
NimbostratusTCP Logging all traffic
My rule is basically the same as the below:
when CLIENT_ACCEPTED {
TCP::collect
{
when CLIENT_DATA {
set DATA [TCP::payload]
log local0. "TCP DATA: $DATA"
TCP:...
jdscrymgeour_42Nimbostratus
NimbostratusThanks for your response,
The second message I should see logged is not written to the log file, and also looking at the counters CLIENT_ACCEPTED and CLIENT_DATA are both actioned the same number of times, it is only a very basic TCP payload of 12 characters pushed through the socket.
Thanks
James
