Hi, On app-layer-detect-proto.c file, you have declared: ... IPPROTO_TCP, ALPROTO_SMB2, "|fe|SMB"... but why you have declared another ALPROTO_SMB2 on hexa? like this: ... IPPROTO_TCP, ALPROTO_SMB2, "|fe 53 4d 42|"... Please change |53 4d 42| to SMB (more easy to read) {not missing |fe| starting}. Regards Rmkml