Aaron - Thanks for the pointer. I am now working on a conceptual model that sets up some global variables in RULE_INIT, uses HTTP_REQUEST to parse the HTTP headers, and CLIENT_DATA to actually manipulate the stream and execute routing. So the general plan is to have a global variable to hold the HTTP payload, one to hold the remote host and one for the remote port. Lastly one global binary variable to set when the entire HTTP payload is read in. So the HTTP_REQUEST reads the content-length header to and sets the _collected flag when the entire HTTP payload is collected. At that point we stuff the HTTP payload and parsed in a global variable. The CLIENT_DATA rule calls TCP::Collect until the _collected flag is true, replaced the TCP Payload with the collected HTTP payload, calls use node with the host and port, and releases the TCP stream. It works on the whiteboard at least. If you see a small mushroom cloud near Pittsburgh you'll know it didn't work. If so, we'll fall back to your suggestion of sticking with the TCP commands and parsing on \r\n\r\n.
Jim
Nimbostratus