Custom signature

[khanj]

Hi,

I have configured an Atomic.TCP signature to log any TCP session when it establishes or resets. Attached is the signature. Please advice what`s wrong with that signature. It is not sensing TCP session despite I have configured the specified ports.

Regards

[micballa]

I believe the "Mask" and "TcpFlags" parameters might be causing your trouble. This signature will only fire when both the PSH and ACK flags are set. You want it set to either SYN for the client's connection, or SYN ACK for the server to detect the connection establishment. You will need another signature where you are looking for the RST flag, to detect the reset case.

[khanj]

Did as per your instruction but same result.