Perhaps this might work, still testing though…
“^.*(get|GET).*(flv).*$”
Without quotes though…
From a wireshark capture, a GET shows up with a request always for a url that contains “noflv”. I keep seeing this “noflv” in every capture i save. Perhaps just matching against a GET request for that string name, it will match and shape correctly.
The original flash pattern file states, without quotes…
“[FC]WS[x01-x09]|FLVx01x05x09”