TCP::payload replace and MSSQL

Hello,

I've done some digging around and come up with this (which might be a bit simplistic and optomistic):

when CLIENT_ACCEPTED {
            TCP::collect 300
        }
when CLIENT_DATA {
        if { [TCP::payload] contains "dbafa" } {
           TCP::payload replace 0 0 "master"
           pool SQL-WiP
        }
}

What I'm really confused with is how to know what he offset and length variables should be for the TCP::payload replace command. I've done some packet inspection and the database name seems to be right at the very end of the data.

Can anyone help?

Simon