# Can I use dsize in rules when ssh is enabled?

**URL:** <https://forum.suricata.io/t/can-i-use-dsize-in-rules-when-ssh-is-enabled/1588>\
**Category:** Rules\
**Created:** [August 5, 2021, 4:46am UTC](https://forum.suricata.io/t/can-i-use-dsize-in-rules-when-ssh-is-enabled/1588 "2021-08-05T04:46:04Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![shyang](https://avatars.discourse-cdn.com/v4/letter/s/a698b9/32.png) [@shyang](https://forum.suricata.io/u/shyang)\
**Post date:** [August 5, 2021, 4:46am UTC](https://forum.suricata.io/t/can-i-use-dsize-in-rules-when-ssh-is-enabled/1588/1 "2021-08-05T04:46:04Z")

</div>

Can I use dsize when ssh is enabled?

Alert is not generated when ssh is enabled.  
If ssh is disabled, may alerts are generated.  
My guess is that ssh decoding affects the dsize.

[information]  
rule:

- alert tcp-pkt any any → any 22 (msg:“ssh dsize test”; flow:established,to\_server; dsize:80; prefilter; sid:1001;)

ssh enabled(suricata-applayers.yaml)  
ssh:  
enabled: yes

ssh disabled(suricata-applayers.yaml)  
ssh:  
enabled: no

There are many tcp.len == 80 packets  
[Flow Keywords](https://suricata.readthedocs.io/en/latest/rules/flow-keywords.html)  
[Don’t Cross The Streams](https://suricata.readthedocs.io/en/latest/rules/differences-from-snort.html?highlight=dsize#don-t-cross-the-streams)

---

<div class="post-metadata">

**Author:** ![syoc](https://avatars.discourse-cdn.com/v4/letter/s/f475e1/32.png) [@syoc](https://forum.suricata.io/u/syoc)\
**Post date:** [August 6, 2021, 7:02am UTC](https://forum.suricata.io/t/can-i-use-dsize-in-rules-when-ssh-is-enabled/1588/2 "2021-08-06T07:02:02Z")

</div>

Interesting. Do you have a pcap you could share or any other way to reproduce?