Matching by eclectic attributes - expiration, state, packet size, etc.?



  • Working on trying to more explicitly throttle downloads, I was wondering if it's possible to match by more eclectic attributes, such as:

    • Expiration - Downloads tend to be >80000
    • Time in State - Downloads tend to be in 4:4 for most of their time
    • Packet Size - Downloads tend to have large packets

    I figure if it's HTTP (80 only), with an expiration of >80000, spending X minutes in state 4:4, having packets which total size of >M, it's likely a download that can be safely throttled.