# Question about mqtt detection

**URL:** <https://forum.suricata.io/t/question-about-mqtt-detection/4890>\
**Category:** Help\
**Tags:** rules, suricata\
**Created:** [October 10, 2024, 2:19am UTC](https://forum.suricata.io/t/question-about-mqtt-detection/4890 "2024-10-10T02:19:49Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![kimichang](https://avatars.discourse-cdn.com/v4/letter/k/c37758/32.png) [@kimichang](https://forum.suricata.io/u/kimichang)\
**Post date:** [October 10, 2024, 2:19am UTC](https://forum.suricata.io/t/question-about-mqtt-detection/4890/1 "2024-10-10T02:19:49Z")

</div>

hi all:  
I meet a problem about mqtt detection.Key words are mqtt.reason\_code and unsubscribe topic.Added some debug log and found reason\_code detection can not capture packet contains reason code field. detect-mqtt-reason-code show suricata register to\_server direction to detect reason\_code,but i found that packets contain reason\_code usually in to\_client direction.

another question is about unsubscribe topic , not work.

rules are :

alert mqtt any any → any any (msg:"MQTT unsubscribe topic "; mqtt.unsubscribe.topic; content:“testtopic”;classtype:misc-attack;sid:5000136;rev:1;)

alert mqtt any any → any any (msg:"MQTT reason code "; mqtt.type:CONNACK; mqtt.reason\_code:134;classtype:misc-attack;sid:5000126;rev:1;)

version:6.0.3  
OS:linux 5.4.86  
install from source

I do need some advice. Thanks a lot.

---

<div class="post-metadata">

**Author:** ![satta](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/satta/32/18_2.png) [@satta](https://forum.suricata.io/u/satta)\
**Post date:** [October 10, 2024, 12:17pm UTC](https://forum.suricata.io/t/question-about-mqtt-detection/4890/2 "2024-10-10T12:17:55Z")

</div>

Thanks for the input. For both cases, could you please provide some pcaps with example MQTT traffic expected output and actual output for further debugging so we can reproduce your issue?  
Please also include information about how you are running Suricata (command line parameters, etc.). Thanks!

---

<div class="post-metadata">

**Author:** ![Philippe\_Antoine](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/philippe_antoine/32/799_2.png) [@Philippe\_Antoine](https://forum.suricata.io/u/Philippe_Antoine)\
**Post date:** [October 13, 2024, 7:17pm UTC](https://forum.suricata.io/t/question-about-mqtt-detection/4890/3 "2024-10-13T19:17:49Z")

</div>

@satta this looks a bug indeed cf SV test mqtt-sub-rules not testing sid 16

---

<div class="post-metadata">

**Author:** ![Philippe\_Antoine](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/philippe_antoine/32/799_2.png) [@Philippe\_Antoine](https://forum.suricata.io/u/Philippe_Antoine)\
**Post date:** [October 13, 2024, 7:44pm UTC](https://forum.suricata.io/t/question-about-mqtt-detection/4890/4 "2024-10-13T19:44:19Z")

</div>

Created [Bug #7323: mqtt: wrong and missing direction for keywords - Suricata - Open Information Security Foundation](https://redmine.openinfosecfoundation.org/issues/7323)

---

<div class="post-metadata">

**Author:** ![satta](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/satta/32/18_2.png) [@satta](https://forum.suricata.io/u/satta)\
**Post date:** [October 14, 2024, 8:50am UTC](https://forum.suricata.io/t/question-about-mqtt-detection/4890/5 "2024-10-14T08:50:49Z")

</div>

Thanks, will look into it