# Cant trigger NFS rules if unit was already mounted **URL:** \ **Category:** Help\ **Created:** [January 5, 2021, 1:33pm UTC](https://forum.suricata.io/t/cant-trigger-nfs-rules-if-unit-was-already-mounted/946 "2021-01-05T13:33:19Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Adrian\_Portas](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/adrian_portas/32/517_2.png) [@Adrian\_Portas](https://forum.suricata.io/u/Adrian_Portas)\ **Post date:** [January 5, 2021, 1:33pm UTC](https://forum.suricata.io/t/cant-trigger-nfs-rules-if-unit-was-already-mounted/946/1 "2021-01-05T13:33:19Z")
Hi, Im using Suricata 5.0.3 in Debian 10 and I am trying to trigger nfs alerts. If Suricata is running before I mount an unit it triggers the alerts correctly, but if I mount the unit and then run suricata i cant trigger the nfs alerts. ¿Am i missing something? I didn a mitm to myself to see if something was wrong with nfs but i could see all the data in wireshark. My rule is: alert nfs any any -\> any 2049 (msg:“NFS: access to testing content”; content:"|74 65 73 74 69 6e 67|";offset:30;sid:1;rev:1;) The mount steps are: sudo mount -o vers=3 NFS\_SERVER\_IP:/exports/lectura /tmp/nfs\_exports cat /tmp/nfs\_exports/testing sudo umount /tmp/nfs\_exports/ Regards, Adrian. ---
**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\ **Post date:** [January 24, 2021, 10:26pm UTC](https://forum.suricata.io/t/cant-trigger-nfs-rules-if-unit-was-already-mounted/946/2 "2021-01-24T22:26:22Z")
Try to create a pcap for both scenarios and see if you can spot the relevant diff. Also you can run the pcaps via -r into suricata again to check if it’s an issue with the packet capture. But without those details, hard to tell why it won’t hit.