# Suricata 7.0.5 file\_data not matching keyword near end of HTTP response body

**URL:** <https://forum.suricata.io/t/suricata-7-0-5-file-data-not-matching-keyword-near-end-of-http-response-body/5934>\
**Category:** Help\
**Tags:** community, rules, suricata\
**Created:** [August 17, 2025, 12:58pm UTC](https://forum.suricata.io/t/suricata-7-0-5-file-data-not-matching-keyword-near-end-of-http-response-body/5934 "2025-08-17T12:58:21Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![abhishek\_sharma](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/abhishek_sharma/32/3683_2.png) [@abhishek\_sharma](https://forum.suricata.io/u/abhishek_sharma)\
**Post date:** [August 17, 2025, 12:58pm UTC](https://forum.suricata.io/t/suricata-7-0-5-file-data-not-matching-keyword-near-end-of-http-response-body/5934/1 "2025-08-17T12:58:21Z")

</div>

Hello,

I’m testing Suricata 7.0.5 and trying to block HTTP traffic based on a keyword inside the file body. I created this rule:

```auto
drop http any any -> any any (msg:"Block Doyle Hound book based on content match"; file_data; content:"wimped"; sid:2300402; rev:1;)

```

To test, I fetch a text file with wget:

```auto
wget --tries=1 --no-check-certificate --bind-address=141.64.201.1 http://www.textfiles.com/computers/weird2_1.txt

```

**Problem:**

- The file downloads completely.
- No alert or log is generated in `eve.json`.
- The keyword (`wimped`) is present near the **end of the file**.

**Config details:**  
My Suricata config has:

```yaml
stream:
  depth: 0
  midstream: true
  drop-invalid: no
  midstream-policy: auto

http:
  enabled: true
  libhtp:
    default-config:
      request-body-limit: 0
      response-body-limit: 0
      request-body-minimal-inspect-size: 500kb
      response-body-minimal-inspect-size: 500kb
      request-body-inspect-window: 4mb
      response-body-inspect-window: 4mb
      http-body-inline: yes

```

**Questions:**

1. With these settings, shouldn’t Suricata scan the _entire_ HTTP response body?
2. Is there a limitation where `file_data` stops scanning before the end of the file if it’s large?
3. Do I need to tweak `response-body-inspect-window` or use `filemagic`/`filestore` to handle this case?
4. How can I debug if Suricata actually sees the keyword in the response body?

**Environment:**

- Suricata version: 7.0.5
- Using default config except for the above rule and body limits.

Thanks for any insights!