Redirect IP to specific node or gateway

What I am seeing is the initial request on TCP 80 is still going out our Cogent connection. Its destination port is 80, but the packet doesn't contain a URI yet, so I think the irule never gets triggered. Its that initial packet that gets dropped. If I watch other sites that aren't blocked, I see traffic initially over Cogent, but then once I start seeing HTTP packets, it will send some things over Charter. Ive looked at some of the IP events, but they seem to rely on a connection getting established, which never happens.