# Can you force UDP packet to be parsed as UDP-ESP instead?

**URL:** <https://forum.suricata.io/t/can-you-force-udp-packet-to-be-parsed-as-udp-esp-instead/4888>\
**Category:** Rules\
**Tags:** ips\
**Created:** [October 9, 2024, 7:49pm UTC](https://forum.suricata.io/t/can-you-force-udp-packet-to-be-parsed-as-udp-esp-instead/4888 "2024-10-09T19:49:53Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ppzapo](https://avatars.discourse-cdn.com/v4/letter/p/bb73d2/32.png) [@ppzapo](https://forum.suricata.io/u/ppzapo)\
**Post date:** [October 9, 2024, 7:49pm UTC](https://forum.suricata.io/t/can-you-force-udp-packet-to-be-parsed-as-udp-esp-instead/4888/1 "2024-10-09T19:49:53Z")

</div>

I have a packet capture where the ip\_proto is 17, UDP. The contents of the packet are correctly identified as ESP in wireshark. When writing my suricata rules, it seems like I can’t leverage the ESP parsing. Is there a way to force the packet through the ESP parser? I would like to take advantage of the SPI and other features already built in.

---

<div class="post-metadata">

**Author:** ![Philippe\_Antoine](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/philippe_antoine/32/799_2.png) [@Philippe\_Antoine](https://forum.suricata.io/u/Philippe_Antoine)\
**Post date:** [October 13, 2024, 7:13pm UTC](https://forum.suricata.io/t/can-you-force-udp-packet-to-be-parsed-as-udp-esp-instead/4888/2 "2024-10-13T19:13:07Z")

</div>

Could you share a pcap ?  
A quick look at the code shows that we use **IPPROTO\_ESP** to decode as ESP…