Forum Discussion
What_Lies_Bene1
Feb 08, 2013Cirrostratus
I'd suggest you remove the white space from this line: set client_src_ip_v0 [ IP::remote_addr ] so its: set client_src_ip_v0 [IP::remote_addr]
Then add a log message in that event as follows: log local0. "$client_src_ip_v0" to ensure that's working.
Also, why are you using [IP::remote_addr] later in the rule when you've set a variable for it earlier?
If that's all OK try commenting out all but the first header insert and doing your capture again and then adding one by one.
+Plus what Kevin said! =]