Forum Discussion
jdscrymgeour_42
Nimbostratus
NimbostratusTCP Logging all traffic
My rule is basically the same as the below:
when CLIENT_ACCEPTED {
TCP::collect
{
when CLIENT_DATA {
set DATA [TCP::payload]
log local0. "TCP DATA: $DATA"
TCP:...
nitass
Employee
Employeeis it http traffic? is there any error in log while sending?
i think tcpdump should show something. if you can't find anything there, can you open a support case? support guy should be able to help you check packet capture.
to capture packet, please use command similar to the following.
tcpdump -nni 0.0:nnn -s0 -w /var/tmp/output.pcap host 1.1.1.1 or host 2.2.2.2
1.1.1.1 is virtual address
2.2.2.2 is pool member address
hope this helps.
