TCP::Collect vs TCP::payload

Hi Sathishkumar123,

the

[TCP::collect 100]

command will make sure that you've buffered at least 100 bytes of data before the

CLIENT_DATA

event triggers. If more TCP payload data has been already arrived in the TCP buffer the

[TCP::payload]

command would be able to access this data too. And if less that 100 bytes of data has been already arrived, it will wait until the remaining data has been arrived (Note: This may stall your TCP connection if the client is requiring a response before sending additional data)

The

[TCP::payload 250]

command will read a maximum of 250bytes from the TCP buffer. If more data is available in the TCP buffer it will accurately trunkate the payload for you. And if less that 250bytes of data are currently in the TCP buffer, it will simply fetch all available data without any complains...

Cheers, Kai