Thanks guys.
I can't segregate traffic based on ip - the desktop domain is one big DHCP VLAN. I can however answer a DNS call with an IP of my choosing, which is far simpler in my situation.
This part is precisely what I was looking to do:
rule myrule {
when HTTP_REQUEST {
if { [string tolower [HTTP::path]] ends_with "ncsi.txt" } {
HTTP::respond 200 content "Microsoft NCSI" noserver Content-Type "text/html" Connection "Close"
}
}
I tried this a dozen different ways which didn't work, but never with the "text/html" field. I'll plug this one in shortly, and verify results.