Looking for pointers in the right direction on what to use - scan/regexpx/Stream Profiles

So the UserID is the first piece of data in the TCP payload (this is obviously not HTTP then)? Is this value in every TCP session (after the handshake)? If yes to both, then perhaps start with this:

when CLIENT_ACCEPTED {
    TCP::collect 400
}
when CLIENT_DATA {
    if { [TCP::payload] starts_with "UserID" } {
        set company [lindex [split [findstr [TCP::payload] "UserID" 6 ","] "@"] 1]
        if { $company ne "" } {
            switch $company {
                "company" { pool company_pool }
                "house" { pool house_pool }
                "car" {pool car_pool }
                default { pool default_pool }
            }
        } 
    }
    TCP::release
}