server_data workflow - what am I doing wrong?

Spark - thanks for the assist. Some background would definitely help. We have a business requirement to develop a VNC client that will connect to a specific VMWare ESX server based on some application rules. The challenge is that our end-user base sits behind networks that are well-locked down; only http/https allowed outbound. Since the ESX servers are already behind an LTM our bright idea was to use an iRule to wrap the VNC socket data as an http payload. This actually works well for the initialization routines, which are basic request-response. The issue arises when the server starts sending screen refresh data. We make a single request which is essentially 'redraw the rectangle with these coordinates', and the server responds with a series of small updates that together make up the full requested screen data. What we had intended to happen is that each of these updates (which I believe come in as individual packets, or at least that's what we see in Wireshark on the server) would get its own http header and be sent as a single distinct response. What we see on Wireshark is a single packet with multiple combinations of http headers (that we add in the iRule) and payload all in one packet. So you may be right that due to the speed of socket data coming over the wire, the iRule fires several times but the tcp stack grabs multiple responses and send them together. Since the socket data from the server is of variable size I'm not sure we can adjust the parameters to force the LTM into a single response. We should be able to inspect the payload and mmake send/don't send decisions based on application data but I was hoping to avoid that since there are six or so different message types and that could be an ugly iRule. :>