Forum Discussion
hooleylist
Jul 13, 2011Cirrostratus
Hi Paul,
Sure, I added this to the example above:
when HTTP_REQUEST {
log local0. "UA: [HTTP::header User-Agent]"
log local0. "Current payload: ([HTTP::payload length] bytes) [HTTP::payload]"
...
I added the same block to the HTTP_REQUEST_DATA event so you can compare before and after collecting the payload.
Aaron