layer 5 port 80 content rule breaks realaudio.

[clayton-price]

I have some layer 5 content rules we are using to filter virus's:

content block_.ida

protocol tcp

port 80

url "/*"

header-field-rule .ida weight 0

add service drop

active

header-field-group .ida

header-field .ida request-line contain ".ida"

This does a great job of filtering what we want, however realaudio which uses port 80 fails. If I disable the content rule the realaudio traffic works.

Any ideas?

Thanks!

[Gilles Dufour]

is it all of them or some of them ?

Did you capture a sniffer trace for a failing one ?

Does it contain ".ida" somewhere ?

Gilles.

[clayton-price]

Thanks for the response. We only have the one real audio stream. I have not seen and reference to .ida within the stream.

Is there anyway to create a content rule stating that all realvideo traffic on port 80 go directly to the original destination with no further processing by the CSS?