Deny Large file download using HTTP::conent-Length

It looks like you're on the right track so far. Have you tested this rule yet? Is it behaving the way you'd expect?

 

 

As far as only opening certain packets goes, that's really not feasible. You're deciding which packets to disallow/alter based on information inside the packet, so you have to open all of them to see if they match or not.

 

 

The up side is, the ones that aren't over your maximum allowed conent length will skip most of the rule, and should cause very little impact to your system.

 

 

-Colin