Forum Discussion
jdscrymgeour_42
Nimbostratus
NimbostratusTCP Logging all traffic
My rule is basically the same as the below:
when CLIENT_ACCEPTED {
TCP::collect
{
when CLIENT_DATA {
set DATA [TCP::payload]
log local0. "TCP DATA: $DATA"
TCP:...
jdscrymgeour_42Nimbostratus
NimbostratusA work around for this is to never use the TCP::release command which I can get away with in my rule using a sideband connection in version 11. and using:
TCP::payload replace 0 [TCP::payload length]""
to empty the collected data.
THanks
James
