Hi, Im test suricata with GRE protocol with example sig: alert ip any any -> any any (msg:"GRE suricata test"; ip_proto:47; classtype:attempted-admin; sid:9431292; rev:1; ) but no alert fired. It's a known pb? If not, Im open a new ticket... Regards Rmkml