Forum Discussion
hooleylist
Nov 16, 2012Cirrostratus
When you have a TCP profile on a virtual server, CLIENT_ACCEPTED is triggered when the client establishes a connection with the virtual server. You'll have the first packet's worth of payload available in the CLIENT_ACCEPTED event. This should be more than 50 bytes. You can check how much payload there is using [TCP::payload length]. If you want to inspect more than the data available in CLIENT_ACCEPTED you can call TCP::collect X and then check [TCP::payload] in CLIENT_DATA.
Aaron