How to determine TCP::payload replace offset value
Hello, I am looking to use TCP::payload replace to change a server response but need assistance with figuring out how to determine the offset. There is a preamble before the string I need to replace and I need to maintain that. Here's what I have so far: when SERVER_CONNECTED { TCP::collect } when SERVER_DATA { set sdata [TCP::payload] if { $sdata contains "foo.bar.com:8080" } { log local0. "sdata found: $sdata" TCP::payload replace 0 [string length $sdata] "widget.com:8080" } TCP::release TCP::collect } Of course the '0' in 'TCP::payload replace 0' will start the replacement at the beginning of the server data response which does not work. How would I determine where in the server data response 'foo.bar.com:8080' starts, which is what I believe the offset value is for?