Forum Discussion
jdscrymgeour_42
Nimbostratus
NimbostratusTCP Logging all traffic
My rule is basically the same as the below:
when CLIENT_ACCEPTED {
TCP::collect
{
when CLIENT_DATA {
set DATA [TCP::payload]
log local0. "TCP DATA: $DATA"
TCP:...
jdscrymgeour_42Nimbostratus
NimbostratusIt is not http traffic it is more like telnet/netcat as above straight ascii TCP messages, and there is no error log, I think the issue is that the following happens:
SYN
SYN, ACK
ACK
PSH, ACK - data
ACK
RST, ACK - f5 sends this to my client
My client then has no open connection to send the next byte of data so does not send it! I have a training day with f5 tomorrow and will ask them
