Why not take the approach of monitoring it instead and triggering alarms based off specific traffic..? So if you use too much foo vs HTTP, trigger an alert. This is one of the things we use Boundary for.