TCP::Release and RST/ACK

Hey everyone,

 

I'm having some really strange behaviour in a rule I derived from some sample code on the site.

 

 

 

when CLIENT_ACCEPTED {

 

TCP::respond "Response Text";

 

TCP::collect

 

TCP::release

 

}

 

 

when CLIENT_DATA {

 

log local0. "In Client Data"

 

....

 

}

 

 

What's really strange is that it never reaches the CLIENT_DATA segment; instead it sends a rst/ack packet after having send the response text. I'm migrating the code over from v9 to v10, and in v9 it worked fine and didn't send resets. Now in v10 it does. What could account for this change? Has anyone else experienced similar issues?