# Application layer protocol rules never trigger

**URL:** <https://forum.suricata.io/t/application-layer-protocol-rules-never-trigger/6158>\
**Category:** Help\
**Tags:** rules, suricata\
**Created:** [January 9, 2026, 10:31am UTC](https://forum.suricata.io/t/application-layer-protocol-rules-never-trigger/6158 "2026-01-09T10:31:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![CyberOrange](https://avatars.discourse-cdn.com/v4/letter/c/e274bd/32.png) [@CyberOrange](https://forum.suricata.io/u/CyberOrange)\
**Post date:** [January 9, 2026, 10:31am UTC](https://forum.suricata.io/t/application-layer-protocol-rules-never-trigger/6158/1 "2026-01-09T10:31:18Z")

</div>

Hello,  
I’m fairly new to Suricata and I’m trying to run some basic tests.

I currently have several TCP/UDP rules that work as expected. However, when I use an application-layer protocol in a rule, it never fires.

For example, this rule works correctly :  
alert tcp any any → any 22 (msg:“This is a tcp test”;sid:1001002;rev:1;)  
But this one does not :  
alert ssh any any → any 22 (msg:“This is an ssh test”;sid:1001003;rev:1;)

Does anyone have an idea what might be causing this? Let me know if you need additional information.

FYI :

- Suricata version : 8.0.2
- Installed via package manager
- OS : Debian 13

---

<div class="post-metadata">

**Author:** ![CyberOrange](https://avatars.discourse-cdn.com/v4/letter/c/e274bd/32.png) [@CyberOrange](https://forum.suricata.io/u/CyberOrange)\
**Post date:** [January 12, 2026, 10:10am UTC](https://forum.suricata.io/t/application-layer-protocol-rules-never-trigger/6158/2 "2026-01-12T10:10:38Z")

</div>

Also, when I do : suricata –dump-config | grep ssh  
I get :  
app-layer.protocols.ssh = (null)  
app-layer.protocols.ssh.enabled = yes

Not sure if this helps, but it may be relevant. 😅

Also, these rules never triggers in IDS mode but triggers when used manually on pcap :  
suricata -r pcap\_output.pcap (pcap of an ssh connection) will trigger the rule

And also the traffic arriving to the suricata server was mirrored via a network TAP before arriving to the server

---

<div class="post-metadata">

**Author:** ![Philippe\_Antoine](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/philippe_antoine/32/799_2.png) [@Philippe\_Antoine](https://forum.suricata.io/u/Philippe_Antoine)\
**Post date:** [January 14, 2026, 7:57am UTC](https://forum.suricata.io/t/application-layer-protocol-rules-never-trigger/6158/3 "2026-01-14T07:57:11Z")

</div>

Do you SSH events in your logs ?

> alert tcp any any → any 22 (msg:“This is a tcp test”;sid:1001002;rev:1;)

This will trigger for a SYN packet

> alert ssh any any → any 22 (msg:“This is an ssh test”;sid:1001003;rev:1;)

This will trigger only after the 3-way handshake if we have the SSH banner

---

<div class="post-metadata">

**Author:** ![CyberOrange](https://avatars.discourse-cdn.com/v4/letter/c/e274bd/32.png) [@CyberOrange](https://forum.suricata.io/u/CyberOrange)\
**Post date:** [January 16, 2026, 9:32am UTC](https://forum.suricata.io/t/application-layer-protocol-rules-never-trigger/6158/4 "2026-01-16T09:32:22Z")

</div>

Hello everyone,

I’ve made some progress and partially solved the issue! It came down to two main things:

- **Hardware:** One of the cables from my TAP was accidentally plugged into a TX port on the Suricata server instead of an RX port.

- **Configuration:** The `livedev` option was set to `use-for-tracking: true`. Since I’m monitoring multiple devices, I disabled it.

**Current status:** I’m still seeing an issue where application layer alerts (FTP, SSH, etc.) only trigger **sometimes**.

After checking my `stats.log`, I noticed a high count of `tcp.pkt_on_wrong_thread`.  
Do you have a idea on what could be the root cause ?