thanks i will try that. as for the 1.4k when i sniffed the transaction my MTU was set to 1460. it has since changed and went to 1.2k. i did a tcpdump and saw the frame sizes negotiated to 1260 also. it seemed to correlate. oddly, when i hit one page with a 116k jpg, the stat incremented to 1 with a size of 1.2k.
i am attaching a jpg screen shot with various info. irule, log, website i hit.
here is the log
Feb 26 10:19:30 tmm tmm[955]: 01220002:6: Rule http_stat_tracker : images_len is 1212
Feb 26 10:20:52 tmm tmm[955]: 01220002:6: Rule http_stat_tracker : Header content is image/JPEG; Charset=utf-8 payload length is 1212
Feb 26 10:20:52 tmm tmm[955]: 01220002:6: Rule http_stat_tracker : images_len is 1212
Feb 26 10:21:06 tmm tmm[955]: 01220002:6: Rule http_stat_tracker : Header content is image/JPEG; Charset=utf-8 payload length is 1212
attached is irule, jpg page size