# Seeing a lot of /libhtp::request\_uri\_not\_seen messages

**URL:** https://forum.suricata.io/t/seeing-a-lot-of-libhtp-request-uri-not-seen-messages/1802
**Category:** Help
**Created:** [October 12, 2021, 1:04am UTC](https://forum.suricata.io/t/seeing-a-lot-of-libhtp-request-uri-not-seen-messages/1802 "2021-10-12T01:04:03Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![darrinh](https://avatars.discourse-cdn.com/v4/letter/d/a87d85/32.png) [@darrinh](https://forum.suricata.io/u/darrinh)
#### Post date: [October 12, 2021, 1:04am UTC](https://forum.suricata.io/t/seeing-a-lot-of-libhtp-request-uri-not-seen-messages/1802/1 "2021-10-12T01:04:03Z")

</div>

Seeing a lot of libht messages:

> signature":“SURICATA HTTP unable to match response to request”,“category”:“Generic Protocol Command Decode”,“severity”:3},“http”:{“http\_port”:0,“url”:“/libhtp::request\_uri\_not\_seen”,“http\_content\_type”:“application/x-javascript”,“status”:200,“length”:2266}

what does ‘/libhtp::request\_uri\_not\_seen’ indicate?

thanks  
Darrin

---

<div class="post-metadata">

### Author: ![jmtaylor90](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jmtaylor90/32/20_2.png) [@jmtaylor90](https://forum.suricata.io/u/jmtaylor90)
#### Post date: [October 12, 2021, 7:07pm UTC](https://forum.suricata.io/t/seeing-a-lot-of-libhtp-request-uri-not-seen-messages/1802/2 "2021-10-12T19:07:40Z")

</div>

Hi Darrin!

In my experience this has been related to packets not being seen by suricata/libhtp. The packets not being seen by suricata/libhtp can be for a number of reasons but the entry you are seeing is basically libhtp saying it doesn’t have the information for that json field.

Hope that helps,

JT

---

<div class="post-metadata">

### Author: ![darrinh](https://avatars.discourse-cdn.com/v4/letter/d/a87d85/32.png) [@darrinh](https://forum.suricata.io/u/darrinh)
#### Post date: [October 12, 2021, 8:55pm UTC](https://forum.suricata.io/t/seeing-a-lot-of-libhtp-request-uri-not-seen-messages/1802/3 "2021-10-12T20:55:06Z")

</div>

Thanks JT, that makes sense in our context as we are using traffic mirroring and are only allowing a subset of traffic to our suricata appliance.

cheers  
Darrin
