# Problems with krb5 parser

**URL:** <https://forum.suricata.io/t/problems-with-krb5-parser/6121>\
**Category:** Rules\
**Tags:** rules\
**Created:** [November 28, 2025, 11:51am UTC](https://forum.suricata.io/t/problems-with-krb5-parser/6121 "2025-11-28T11:51:32Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![Philippe\_Antoine](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/philippe_antoine/32/799_2.png) [@Philippe\_Antoine](https://forum.suricata.io/u/Philippe_Antoine)\
**Post date:** [December 3, 2025, 8:55pm UTC](https://forum.suricata.io/t/problems-with-krb5-parser/6121/5 "2025-12-03T20:55:14Z")

</div>

This is because `krb5_sname` only works to client.

The doc [8.26. Kerberos Keywords — Suricata 9.0.0-dev documentation](https://docs.suricata.io/en/latest/rules/kerberos-keywords.html#krb5-sname) states

> Kerberos server name, provided in the ticket (for AS-REQ and TGS-REQ messages) or in the error message.

But it looks to only work for the error message, as enforced by SV test krb5-request-frag-log

I think this is a bug and fix would be simply

```diff

diff --git a/src/detect-krb5-sname.c b/src/detect-krb5-sname.c
index 3cbe6185bb..93c499cda2 100644
--- a/src/detect-krb5-sname.c
+++ b/src/detect-krb5-sname.c
@@ -62,6 +62,8 @@ void DetectKrb5SNameRegister(void)
 
     DetectAppLayerMultiRegister(
             "krb5_sname", ALPROTO_KRB5, SIG_FLAG_TOCLIENT, 1, SCKrb5TxGetSname, 2);
+ DetectAppLayerMultiRegister(
+ "krb5_sname", ALPROTO_KRB5, SIG_FLAG_TOSERVER, 1, SCKrb5TxGetSname, 2);
 
     DetectBufferTypeSetDescriptionByName("krb5_sname",
             "Kerberos 5 ticket server name");

```

---

_[View the full topic](https://forum.suricata.io/t/problems-with-krb5-parser/6121)._