Hi, No error with Suricata v100 or git 25 jul with this sig: alert udp any any -> any any (msg:"test"; content:"||"; sid:238011;) Error with snort. I you want, Im open a new ticket. Regards Rmkml