Hash detection issue

Help
1

Hello,

I got an issue implementing file hash detection in suricata.

I’ve created a rule based on md5 hash. Unfortunately, the rule never pop off.
After verification, I find out that the hash generated by md5checksum is different than the hash generated by Suricata in file-store.

Does anyone has any clue on how to solve this?

Thank you,

2

Hi,
Could you post your rule?

Could you post a pcap with the file?