# Keyword: flowbits:isset,http.dottedquadhost

**URL:** <https://forum.suricata.io/t/keyword-flowbits-isset-http-dottedquadhost/3170>\
**Category:** Rules\
**Created:** [January 30, 2023, 3:25pm UTC](https://forum.suricata.io/t/keyword-flowbits-isset-http-dottedquadhost/3170 "2023-01-30T15:25:21Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![DonGarrison](https://avatars.discourse-cdn.com/v4/letter/d/cc9497/32.png) [@DonGarrison](https://forum.suricata.io/u/DonGarrison)\
**Post date:** [January 30, 2023, 3:25pm UTC](https://forum.suricata.io/t/keyword-flowbits-isset-http-dottedquadhost/3170/1 "2023-01-30T15:25:21Z")

</div>

I’m receiving an error “error\_code”:306,“error”:" SC\_WARN\_FLOWBIT",“message”:“flowbit ‘http.dottedquadhost’ is checked but not set…” on an ETPro rule.

What does this check for? flowbits:isset,http.dottedquadhost

---

<div class="post-metadata">

**Author:** ![jmtaylor90](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jmtaylor90/32/20_2.png) [@jmtaylor90](https://forum.suricata.io/u/jmtaylor90)\
**Post date:** [January 30, 2023, 7:01pm UTC](https://forum.suricata.io/t/keyword-flowbits-isset-http-dottedquadhost/3170/2 "2023-01-30T19:01:04Z")

</div>

Hi,

There are a number of rules that control that particular flowbit so we need a bit more information to help you track the issue down further. The best option is probably opening a support ticket with ET directly at [Feedback](https://feedback.emergingthreats.net/feedback). Please supply full log details and any distabled sids/categories in your rule management (suricata-update/pulledpork/etc).

JT

---

<div class="post-metadata">

**Author:** ![DonGarrison](https://avatars.discourse-cdn.com/v4/letter/d/cc9497/32.png) [@DonGarrison](https://forum.suricata.io/u/DonGarrison)\
**Post date:** [January 30, 2023, 7:04pm UTC](https://forum.suricata.io/t/keyword-flowbits-isset-http-dottedquadhost/3170/3 "2023-01-30T19:04:04Z")

</div>

Will do – Good advice. I was hesitant about posting a full ETPro rule here, they would likely frown on that 😃

---

<div class="post-metadata">

**Author:** ![DonGarrison](https://avatars.discourse-cdn.com/v4/letter/d/cc9497/32.png) [@DonGarrison](https://forum.suricata.io/u/DonGarrison)\
**Post date:** [January 31, 2023, 1:45pm UTC](https://forum.suricata.io/t/keyword-flowbits-isset-http-dottedquadhost/3170/4 "2023-01-31T13:45:52Z")

</div>

After contacting ET - They indicated the issue was related to some disabled rules from the INFO category. Issue resolved.