<html><head></head><body><div style="font-family: Verdana;font-size: 12.0px;"><div>Yes, I tried it command line as well as in the conf file.
<div>
<div name="quote" style="margin:10px 5px 5px 10px; padding: 10px 0 10px 10px; border-left:2px solid #C3D9E5; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div style="margin:0 0 10px 0;"><b>Sent:</b> Saturday, April 01, 2017 at 1:36 PM<br/>
<b>From:</b> "Andreas Herz" <andi@geekosphere.org><br/>
<b>To:</b> oisf-users@lists.openinfosecfoundation.org<br/>
<b>Subject:</b> Re: [Oisf-users] HTTP Parsing on partial PCAP</div>
<div name="quoted-content">On 29/03/17 at 22:03, secres@linuxmail.org wrote:<br/>
><br/>
> I upgraded to 3.2.1 but I still have the same issue.<br/>
<br/>
Did you try this setting as Victor did suggest?<br/>
<br/>
--set stream.midstream=true<br/>
<br/>
--<br/>
Andreas Herz<br/>
_______________________________________________<br/>
Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br/>
Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" target="_blank">http://suricata-ids.org/support/</a><br/>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a></div>
</div>
</div>
</div></div></body></html>