That should not be the case, I’ve been testing the http.* keywords against HTTP/2 traffic for several months without majar issues. This seems like a very different issue. Keep in mind that HTTP/2 is largely encrypted, so validating that you’ve got clear text HTTP/2 is important and then making sure the protocol and http2.http1-rules options are enabled in the config would be next. Suri 7 ships with those options enabled by default.