TCP Logging all traffic

My rule is basically the same as the below:

 

 

when CLIENT_ACCEPTED {

 

TCP::collect

 

{

 

when CLIENT_DATA {

 

set DATA [TCP::payload]

 

log local0. "TCP DATA: $DATA"

 

TCP::release

 

TCP::collect

 

}

 

 

The problem is that the client accpted event occurs capturing the initial packet, however the client stays connected for multiple packets and the TCP::collect within CLIENT_DATA does not seem to trigger the CLIENT_DATA event again!

 

 

UDP works very nicely just collecting each packet sent because it is connectionless, however my issue is with TCP and I cannot change this!

 

 

Any advise would be greatly appreciated

 

 

THanks

 

 

James