Hello,

I understand that RouterOS will capture the first n frames / n bytes of a connection and run the RegEx against that data. However, I'm just not getting any results.

The problem:
I want to identify Streaming Media - so I have the following partial RegExps:
GET .*(webm|mp4|ogg)
.*Content-Type:.*audio.*
.*Content-Type:.*video.*

Obviously the first is outbound data and should match the very start of the conversation, the HTTP GET.
In the case that this doesn't work, one of the other two should pick up the Content-Type in the response headers.

(I'm happy for some fringe cases to escape this matching - e.g. filename doesn't end webm, mp4, ogg, and server doesn't declare content-type.)

None of the above seem to be having any effect, when either in the forward or output chains.

To test, other than just looking at the bytes/packets, I'm attempting to Log the IP addresses - but nothing is appearing.

Here are my firewall rules (from /ip firewall filter print)
Any assistance gratefully appreciated.

Looking at that GET RegEx again, it should also capture any page with "webm" in the name, e.g. "webmail" - I should be able to get that to work by attempting to GET /webmail on any server (e.g. www.amazon.com/webmail) - the server will return an error page, but I will have sent a string that should match.

Unfortunately even that doesn't match.

Updated regex, still no joy

Thanks, all.