Applying rules to Real Media Streams

A cut'n'paste from chapter 5 of the reference guide:

"An accumulate statement terminates rules processing until another another packet containing additional data is received from the originating client. This statement is useful with the http_content and tcp_content rule variables, when not enough data has been received to be successfully evaluated. For information on these rule variables, see Variables."

I've never tested it with real networks stuff, but I'd be surprised if some combination of tcp_content, tcp_bytes_collected, and the accumulate statement wouldn't do what you want.

As a matter of practice, if you have several files you want to include, I'd add them to their own "allowedRealStreamFiles" class and do something like the (untested) following:

 
  
  assumption:  you want an deny what's not allowed approach for streams 
 b class allowedRealStreamFiles '{ "test1.ra" "test2.ram" "zzz.ra" }' 
  
  replace the 3600 with something from testing 
 b rule realMediaFilter { 
    if(tcp_content contains one of allowedRealStreamFiles) { 
        use pool outboundgateways 
    }  
    else if(tcp_bytes_collected < 3600) { 
        accumulate 
    } else { 
         discard 
    } 
 } 
 

Or something like that. . .I don't have easy access to a real server.

Good luck!

--Brad