Hi, I have a error with this sig: alert udp any any -> any any (msg:"test"; content:""; sid:238012;) But no error with this sig: alert udp any any -> any any (msg:"test"; content:''; sid:238013;) Maybe check, and if you Im open a new ticket. Regards Rmkml