# Suricata can't define IP options
**URL:** https://forum.suricata.io/t/suricata-cant-define-ip-options/4494
**Category:** Rules
**Tags:** rules, suricata
**Created:** [February 20, 2024, 7:56am UTC](https://forum.suricata.io/t/suricata-cant-define-ip-options/4494 "2024-02-20T07:56:37Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@Dion](https://forum.suricata.io/u/Dion)
#### Post date: [February 20, 2024, 7:56am UTC](https://forum.suricata.io/t/suricata-cant-define-ip-options/4494/1 "2024-02-20T07:56:37Z")
Hello,
I try use ipopts : ssrr in my rules. But I get alert any case when set any IP flag in packet.
---
### Author:  [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)
#### Post date: [February 20, 2024, 1:35pm UTC](https://forum.suricata.io/t/suricata-cant-define-ip-options/4494/2 "2024-02-20T13:35:53Z")
What version of Suricata are you using?
What platform and release (Linux x.y, Macos 10.x, …)?
Can you provide the rule?
---
### Author:  [@Dion](https://forum.suricata.io/u/Dion)
#### Post date: [February 21, 2024, 1:16pm UTC](https://forum.suricata.io/t/suricata-cant-define-ip-options/4494/3 "2024-02-21T13:16:48Z")
Suricata version: **6.0.4**
Platform: **Linux**
Rule: `alert ip any any -> any any (ipopts: ssrr; msg: "issue"; rev: 1; sid:1;)`
---
### Author:  [@Dion](https://forum.suricata.io/u/Dion)
#### Post date: [February 28, 2024, 11:56am UTC](https://forum.suricata.io/t/suricata-cant-define-ip-options/4494/4 "2024-02-28T11:56:52Z")
Do you have some updates? =)
---
### Author:  [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)
#### Post date: [February 28, 2024, 8:52pm UTC](https://forum.suricata.io/t/suricata-cant-define-ip-options/4494/5 "2024-02-28T20:52:26Z")
Can you also provide the pcap?
---
### Author:  [@Dion](https://forum.suricata.io/u/Dion)
#### Post date: [March 12, 2024, 12:29pm UTC](https://forum.suricata.io/t/suricata-cant-define-ip-options/4494/6 "2024-03-12T12:29:44Z")
[84b58b808f9f81c09728cb923a2c0eb0.pcap](https://forum.suricata.io/uploads/short-url/ryMLgXeJQmMTN4nhnfJEmOFCbt2.pcap) (730 Bytes)
Yes, sure
---
### Author:  [@Dion](https://forum.suricata.io/u/Dion)
#### Post date: [March 18, 2024, 10:30am UTC](https://forum.suricata.io/t/suricata-cant-define-ip-options/4494/7 "2024-03-18T10:30:21Z")
Do you have some updates? =)
---
### Author:  [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)
#### Post date: [March 18, 2024, 12:53pm UTC](https://forum.suricata.io/t/suricata-cant-define-ip-options/4494/8 "2024-03-18T12:53:15Z")
Thanks for bringing this to our attention. There may be an issue with how this is handled so I created [Bug #6864: Detect: ipopts keyword misfires - Suricata - Open Information Security Foundation](https://redmine.openinfosecfoundation.org/issues/6864) to track it.
---
### Author:  [@Dion](https://forum.suricata.io/u/Dion)
#### Post date: [March 19, 2024, 10:49am UTC](https://forum.suricata.io/t/suricata-cant-define-ip-options/4494/9 "2024-03-19T10:49:26Z")
Thank you very match!
---
### Author:  [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)
#### Post date: [March 23, 2024, 1:21pm UTC](https://forum.suricata.io/t/suricata-cant-define-ip-options/4494/10 "2024-03-23T13:21:59Z")
I’ve prepared a PR with the changes – if you’re able to build with my PR, let me know if this works for you
>
>
> Continuation of #10688
>
> Support multiple options.
>
> This PR changes the IP o…ption definitions from an enum into bit values so the values added during packet parsing are compared properly when evaluation with an IP option specified with \`ipopts\` occurs.
>
> Link to \[redmine\](https://redmine.openinfosecfoundation.org/projects/suricata/issues) ticket: \[6864\](https://redmine.openinfosecfoundation.org/issues/6864)
>
> Describe changes:
> \- Misc. cleanups
> \- Move IPv4 option values to a bit mask
> \- suricata-verify test to validate each option lacking coverage.
>
> Updates:
> \- Remove unneeded PCRE usage
>
> \### Provide values to any of the below to override the defaults.
>
> To use a pull request use a branch name like \`pr/N\` where \`N\` is the
> pull request number.
>
> Alternatively, \`SV\_BRANCH\` may also be a link to an
> OISF/suricata-verify pull-request.
>
> \`\`\`
> SV\_REPO=
> SV\_BRANCH=pr/1722
> SU\_REPO=
> SU\_BRANCH=
> LIBHTP\_REPO=
> LIBHTP\_BRANCH=
> \`\`\`