Hi,
I could not test, but basically you have to replace the TCP::payload.
I also think that the [string match] you need to change the pattern to "*Exchange2010R2*"
As a tip, write some logs with the values of the things on the main points to see if everything is going well and then remove.
See if this helps you. []
when CLIENT_ACCEPTED {
TCP::respond "220\r\n"
TCP::collect 2000
}
when CLIENT_DATA {
set cdata [TCP::payload]
if { $cdata starts_with "DATA" } {
if { [string match "*Exchange2010R2*" $cdata ]} {
TCP::payload replace 0 [TCP::payload length] [string map {"Sent From:" "Sent From:\nExchange 2010 R2 Server\n"} [TCP::payload]]
}
}
TCP::release
TCP::collect
}