[Oisf-users] rule using http protocol not working

[Victor Julien]

On 19-02-19 19:38, GORHAM JOHNSON, OZELINA wrote:
> pcap file attached

The pcap contains just one side of the traffic it seems, so maybe you
need the stream.async-oneside option to be enabled.

Better would be to make sure Suricata sees both sides of the traffic.

-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------