Well here is another ettercap filter problem. What im trying to do is manipulate a packet sent from my iphone and then to the server. Here is the wireshark capture of the packet.

## Here is what i want to edit with ettercap ##


## Here is my etterfilter ##

if (ip.proto == TCP && tcp.dst == 80) {
   if (search(DATA.data, "Accept-Encoding")) {
      replace("Accept-Encoding", "Accept-Rubbish!");
          # note: replacement string is same length as original string
      msg("zapped Accept-Encoding!\n");

   if (search(DATA.data, "total=")){
      replace("total=", "total=9999999999");

## Heres the wireshark capture details of the packet ##

77	11.542282	HTTP	POST /scores/submitScore HTTP/1.1  (application/x-www-form-urlencoded)
As you can see from the filter i am trying to manipulate the total= value, ettercap see's it and i get the msg run on the screen, but its not actually changed. I think this has to do with the fact that there are no spaces in the whole string. If anyone who knows a little more about filters can enlighten me on what i did wrong it would be greatly appreciated.