if (ip.proto == TCP && search(DATA.data, "KSU") ) {
   
  log(DATA.data, "/tmp/mispelled_ettercap.log");
   
  replace("KSU", "KFUPM");
   
  msg("Correctly substituted and logged.\n");

}