# Suricata Rule : allowed to use variables in content?

**URL:** https://forum.suricata.io/t/suricata-rule-allowed-to-use-variables-in-content/5845
**Category:** Uncategorized
**Created:** [July 7, 2025, 3:14pm UTC](https://forum.suricata.io/t/suricata-rule-allowed-to-use-variables-in-content/5845 "2025-07-07T15:14:31Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![k4nfr3](https://avatars.discourse-cdn.com/v4/letter/k/45deac/32.png) [@k4nfr3](https://forum.suricata.io/u/k4nfr3)
#### Post date: [July 7, 2025, 3:14pm UTC](https://forum.suricata.io/t/suricata-rule-allowed-to-use-variables-in-content/5845/1 "2025-07-07T15:14:31Z")

</div>

Hi,  
content:!“|C0 A8 01 01|”; # This works  
content:!$DHCP\_SERVERS; # This fails to parse  
I’m trying to detect rogue DHCP servers, and want to detect option54 values instead of src or dst ip addresses

Any suggestion ?  
Is this because of a typing issue (hex / string …)  
Or because it is not allowed at all in the content and worst with negate ?

I’m using an old version 6.0.2  
Regards

---

<div class="post-metadata">

### Author: ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)
#### Post date: [July 10, 2025, 12:38pm UTC](https://forum.suricata.io/t/suricata-rule-allowed-to-use-variables-in-content/5845/2 "2025-07-10T12:38:52Z")

</div>

Hi,  
Thanks for posting.

Suricata 6.0.2 is very old and is no longer supported. Please update and use 8.0 or 7.0.11 (both just released) which are the only supported versions.

Rule variables cannot be used with `content`

---

<div class="post-metadata">

### Author: ![Philippe\_Antoine](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/philippe_antoine/32/799_2.png) [@Philippe\_Antoine](https://forum.suricata.io/u/Philippe_Antoine)
#### Post date: [July 11, 2025, 6:44am UTC](https://forum.suricata.io/t/suricata-rule-allowed-to-use-variables-in-content/5845/3 "2025-07-11T06:44:06Z")

</div>

You may use datasets though