Hi All, In snort, the flow_depth option of http_inspect preprocessor is able to specify the amount of server response payload to inspect. This option increases performance to handle HTTP traffic. Is there any similar option in suricata. Thanks, Sean.