Forum Discussion
Lee_Sutcliffe
Nacreous
when CLIENT_ACCEPTED {
log local0. "Client IP:[IP::client_addr]"
}
You'll need to do this in the CLIENT_ACCEPTED event as above
David_M
Jun 24, 2019Cirrostratus
I dont know why I dont see my client connected firing at all!!
- Lee_SutcliffeJun 24, 2019Nacreous
the CLIENT_ACCEPTED event triggers when a TCP three way handshake has been completed. If you're not seeing anything in the logs it may be because your ISP is multiplexing TCP connections. This is common if you have services behind Akamai for example.