I'm looking for possibility to look into the data with ip-tables. not proxies or anything - proxies are too slow ... imho That may be, but have you considered that iptables let you work on packets and that the string you are looking for can easily be broken into two parts: one half at the end of one packet, the other hals at the beginning of the next. Simply filtering with iptables for a string will do so without any regard for the context of that string. Consider receiving a virus warning Email with "do not open any .pif attachments".
If you still want to persue this path, you could consider experimenting with user-space filering. You'll find that in the kernel config menu. I've not got any experience with that personally, and have no plans in that direction either. Peter Oh, and one more thing:
Mit freundlichen Grüßen / Best regards [ SNIP SNIP SNIP ]
Try to quote a little bit more friendly next time.