Forum Discussion
jdscrymgeour_42
Nimbostratus
NimbostratusTCP Logging all traffic
My rule is basically the same as the below:
when CLIENT_ACCEPTED {
TCP::collect
{
when CLIENT_DATA {
set DATA [TCP::payload]
log local0. "TCP DATA: $DATA"
TCP:...
jdscrymgeour_42Nimbostratus
NimbostratusThe easiest way to recreate my problem is using netcat or similar, sending the data to the virtual server, the basic TCP construction looks like this::
SYN
SYN, ACK
ACK
PSH, ACK - data
ACK
PSH, ACK - data - not receiving/ logging this message
ACK
FIN, ACK
FIN, ACK
when I get this working I will also expect a response to each of the bytes of data sent from the end point, however I am currently failing at this hurdle!
