<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"></head><body>Hi,<div>Anyone confirm my strange results please? If yes Im open a new redmine ticket.</div><div><br></div><div>ok start a wget http request :</div><div> wget --user-agent="Mozilla\";" http://x.y.com</div><div>(results are User-Agent: Mozilla"; )</div><div><br></div><div>1) ok create a very simple sig, Suricata fire:</div><div>... flow:to_server,established; content:"\"\;"; ...</div><div><br></div><div><br></div><div>2) another sig but Suricata not fire, why?</div><div>... flow:to_server,established; content:"\"\;"; http_header; ...</div><div><br></div><div><div><br></div><div>3) another sig but Suricata not fire, why?</div><div>... flow:to_server,established; content:"\"\;"; http_user_agent; ...</div></div><div><br></div><div>Same pb when replace " to |22|</div><div>or ; to |3b|.</div><div><br></div><div>Of course Snort fire every times.</div><div>Regards</div><div>Rmkml</div><div><br></div></body></html>