Assuming the HTTP profile only breaks the WS traffic when the payload is sent, you could try disabling the HTTP profile with HTTP::disable if you see a URI::protocol value of ws://. It would be tricky to re-enable the HTTP profile if clients (or intermediate proxies) can use http:// or https:// with ws:// on the same TCP connection.
Can you try something like this?
when HTTP_REQUEST {
log local0. "[IP::client_addr]:[TCP::client_port]: [HTTP::method] request to [HTTP::host], [HTTP::uri]"
if {[string tolower [URI::protocol [HTTP::uri]]] eq "ws"}{
log local0. "[IP::client_addr]:[TCP::client_port]: Disabling HTTP filter for [URI::protocol [HTTP::uri]]"
HTTP::disable
}
}
Aaron