this may not be in here yet... maybe it's not easy... but if someone could
point me in the right direction that would be a start...

Other firewalls support passing requests made by certain applications...
zone alarm or black ice for example - and the parts they have integrated
with linksys routers... can detect a bogus HTTP request generated by a
program OTHER THAN Internet Explorer (like by a virus or a messenger program
trying to circumvent the firewall) and shut them down...

They are able to detect the NAME of the application initiating the
request...

I'm thinking this is parallel to identd, but seems to be built into
windows... Does anyone know what it's called or where the protocol is
defined? Could be an interesting addition... I'd like to poke around in this
area, but can't find where to start.

Thanks.