Forum Discussion
tatmotiv
Cirrostratus
Jul 09, 2015Digging deeper into the issue, I thought about something like that...
when CLIENT_ACCEPTED {
TCP::collect 50
}
when CLIENT_DATA {
set payload_first_50 [TCP::payload]
set persist_string [substr $payload_first_50 29 20]
log local0. "Fetched $persist_string as conn ID for client [IP::client_addr]."
persist uie $persist_string 60
TCP::release
}
... but I'm not sure if the data returned by [TCP::payload] is to be considered a string, thus being unsure whether using the substr method on it will return valid data.