Hi Enrik, of course the traffic passes trought squid :-) in most cases squid says in the mimetype compound of the access log = video/x-ms-asf or similar flavours, an example entry is:
1078747598.078 1513 192.168.5.110 TCP_MISS/206 665017 GET = http://www.coolioz.com/stagione0304/0304_goal_juventusroma_chivu1.avi - =DIRECT/62.149.130.111 video/x-msvideo 1078747719.833 420 192.168.6.30 TCP_MISS/200 22365 GET = http://rainweb2.streamguys.com/logicasx.aspx? - DIRECT/64.202.98.48 = video/x-ms-asf
