# Applayer and flowbits issues **URL:** \ **Category:** Rules\ **Tags:** rules, suricata\ **Created:** [August 5, 2025, 1:15pm UTC](https://forum.suricata.io/t/applayer-and-flowbits-issues/5912 "2025-08-05T13:15:04Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![s1ncr](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/s1ncr/32/3450_2.png) [@s1ncr](https://forum.suricata.io/u/s1ncr)\ **Post date:** [August 5, 2025, 1:15pm UTC](https://forum.suricata.io/t/applayer-and-flowbits-issues/5912/1 "2025-08-05T13:15:04Z")
Run Suricata via jasonish/suricata:8.0.0-arm64-profiling docker in pcap mode I encounter some interesting problem with app protos and flowbits, lets say i have rules like this ```auto alert dcerpc any any -> any any (msg:"dcerpc uuid [lsarpc]"; flow:established, to_server; dcerpc.iface:12345778-1234-abcd-ef00-0123456789ab; flowbits:set,lsarpc; flowbits:noalert; sid:1; rev:1;) alert smb any any -> any any (msg:"smb uuid [lsarpc]"; flow:established, to_server; content:"SMB"; content:"|05 00 0b|"; distance:0; content:"|78 57 34 12 34 12 cd ab ef 00 01 23 45 67 89 ab|"; distance:29; flowbits:set,lsarpc; flowbits:noalert; sid:2; rev:1;) alert smb any any -> any any (msg:"DPAPI Backup Key Extraction"; flow:established, to_server; content:"B|00|C|00|K|00|U|00|P|00|K|00|E|00|Y"; flowbits:isset,lsarpc; sid:3; rev:1;) ``` I expect rule 3 to trigger on this pcap [dpapi-detect.pcap](https://forum.suricata.io/uploads/short-url/24LbIEoQji4PmTWHhpoJDveNhBr.pcap) (15.4 KB) But no alerts are triggered (both set flowbits are triggered but suppressed) Stat log: [dpapi-stats.log](https://forum.suricata.io/uploads/short-url/okHqjoiDTIxxClsWtjoGsja9cMd.log) (5.5 KB) But when I remove sig 1, or edit it so it doesn’t match ```auto alert dcerpc any any -> any any (msg:"dcerpc uuid [lsarpc]"; flow:established, to_server; dcerpc.iface:12345778-1234-abcd-ef00-0123456789aasd; flowbits:set,lsarpc; flowbits:noalert; sid:1; rev:1;) alert smb any any -> any any (msg:"smb uuid [lsarpc]"; flow:established, to_server; content:"SMB"; content:"|05 00 0b|"; distance:0; content:"|78 57 34 12 34 12 cd ab ef 00 01 23 45 67 89 ab|"; distance:29; flowbits:set,lsarpc; flowbits:noalert; sid:2; rev:1;) alert smb any any -> any any (msg:"DPAPI Backup Key Extraction"; flow:established, to_server; content:"B|00|C|00|K|00|U|00|P|00|K|00|E|00|Y"; flowbits:isset,lsarpc; sid:3; rev:1;) ``` I got alert for sig 3 Is this expected behaviour caused by app layer mismatch or some sort of bug? Also i cant get alert from dcerpc set and smb isset sigs ---
**Author:** ![Philippe\_Antoine](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/philippe_antoine/32/799_2.png) [@Philippe\_Antoine](https://forum.suricata.io/u/Philippe_Antoine)\ **Post date:** [August 12, 2025, 7:42pm UTC](https://forum.suricata.io/t/applayer-and-flowbits-issues/5912/2 "2025-08-12T19:42:36Z")
> I expect rule 3 to trigger on this pcap > > But no alerts are triggered (both set flowbits are triggered but suppressed) I do get an alert for signature 3 with master at commit b93a27722c29e10f69ff32eadbd2964aa254000e Do you use `-k none` as suggested by log > Warning: pcap: 1/2th of packets have an invalid checksum, consider setting pcap-file.checksum-checks variable to no or use ‘-k none’ option on command line. [ReceivePcapFileThreadExitStats:source-pcap-file.c:409] ---
**Author:** ![s1ncr](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/s1ncr/32/3450_2.png) [@s1ncr](https://forum.suricata.io/u/s1ncr)\ **Post date:** [August 13, 2025, 11:10am UTC](https://forum.suricata.io/t/applayer-and-flowbits-issues/5912/3 "2025-08-13T11:10:56Z")
Yes In cli and in cfg ```auto Config: stream-tcp: stream "checksum-validation": disabled [StreamTcpInitConfig:stream-tcp.c:572] ``` Now i run suricata in docker-compose something like this ```auto docker run --rm -it \ ... some directory and files includes ... jasonish/suricata:8.0.0-arm64-profiling \ -c /nsm/suricata.yaml \ -s /nsm/test.rules \ -r /nsm/dpapi.pcap \ --runmode autofp \ -k none \ -vvvv \ -l /var/log/suricata/ ``` Maybe problem can be in cfg file, but i can t find anything abnormal here [suricata.yaml](https://forum.suricata.io/uploads/short-url/jhLnjEdzHoYWlmFsu9cg3ghxJex.yaml) (9.1 KB) Also tried with version that you mention, but still cant get alert from sig 3 Do you try with first pac of 3 sigs? ---
**Author:** ![Philippe\_Antoine](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/philippe_antoine/32/799_2.png) [@Philippe\_Antoine](https://forum.suricata.io/u/Philippe_Antoine)\ **Post date:** [August 24, 2025, 6:33pm UTC](https://forum.suricata.io/t/applayer-and-flowbits-issues/5912/4 "2025-08-24T18:33:55Z")
I tried the first 3-pack of signatures. It works if you change your config to have stream.reassembly.toserver-chunk-size: 2560 @sbhardwaj looks like SMB is missing `sc_app_layer_parser_trigger_raw_stream_inspection` calls, what do you think ? ---
**Author:** ![s1ncr](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/s1ncr/32/3450_2.png) [@s1ncr](https://forum.suricata.io/u/s1ncr)\ **Post date:** [August 25, 2025, 8:21am UTC](https://forum.suricata.io/t/applayer-and-flowbits-issues/5912/5 "2025-08-25T08:21:16Z")
That does work, indeed. But I don’t quite understand why reducing the chunk size helped. ---
**Author:** ![sbhardwaj](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/sbhardwaj/32/10_2.png) [@sbhardwaj](https://forum.suricata.io/u/sbhardwaj)\ **Post date:** [August 25, 2025, 2:14pm UTC](https://forum.suricata.io/t/applayer-and-flowbits-issues/5912/6 "2025-08-25T14:14:26Z")
@Philippe_Antoine indeed. Added this ticket: [Task #7863: smb: trigger raw stream inspection - Suricata - Open Information Security Foundation](https://redmine.openinfosecfoundation.org/issues/7863) @s1ncr there’s a bug about delayed inspection of data in Suricata when the data is under chunk size. I have tried to explain this here for SIP for example: [sip: trigger raw stream inspection · OISF/suricata@a558307 · GitHub](https://github.com/oisf/suricata/commit/a5583075f) I missed doing the fix for SMB. Hope this helps ---
**Author:** ![s1ncr](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/s1ncr/32/3450_2.png) [@s1ncr](https://forum.suricata.io/u/s1ncr)\ **Post date:** [August 25, 2025, 2:37pm UTC](https://forum.suricata.io/t/applayer-and-flowbits-issues/5912/7 "2025-08-25T14:37:37Z")
Thank you for explanation