Forum Discussion
richard_77048
Mar 25, 2012Nimbostratus
It seems to work for me. I guess I should have asked what version you were using. I'd be surprised if that made a difference here but you never know.
when CLIENT_ACCEPTED {
if { [TCP::client_port] equals "49562" } {
log local0.debug "client: [IP::client_addr]:[TCP::client_port]"
}
}
Mar 25 02:08:12 local/tmm debug tmm[7030]: Rule TEST-source-port-RULE : client: xx.xx.xxx.xx:49562