# Suricata Rules HTTP Header not working

**URL:** <https://forum.suricata.io/t/suricata-rules-http-header-not-working/4120>\
**Category:** Rules\
**Created:** [October 30, 2023, 3:00am UTC](https://forum.suricata.io/t/suricata-rules-http-header-not-working/4120 "2023-10-30T03:00:41Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![gosudvtnews](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/gosudvtnews/32/2458_2.png) [@gosudvtnews](https://forum.suricata.io/u/gosudvtnews)\
**Post date:** [October 30, 2023, 3:00am UTC](https://forum.suricata.io/t/suricata-rules-http-header-not-working/4120/1 "2023-10-30T03:00:41Z")

</div>

Here is my rules:  
`alert http any any -> any any (msg:"TEST"; http.method; content:"POST"; http.uri; content:"/test"; http.header; content:"Transfer-Encoding|3a 20|chunked, chunked"; fast_pattern; sid:10000000;) `  
I tried with Request bellow but Suricata does not throw Alert, some one can help me. Thanks  
 ![image](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/a/a56b7e6666f3059ec4289d800823ac83bd98cf4e.png)

---

<div class="post-metadata">

**Author:** ![lukashino](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/lukashino/32/1150_2.png) [@lukashino](https://forum.suricata.io/u/lukashino)\
**Post date:** [October 30, 2023, 8:56am UTC](https://forum.suricata.io/t/suricata-rules-http-header-not-working/4120/2 "2023-10-30T08:56:19Z")

</div>

What is your (traffic) input? Are you feeding a PCAP to Suricata? Or are you listening live on the device?

Suricata needs to see full flow from the beginning (unless extra settings are specified), so if you are only investigating on a single packet then that will not work.

---

<div class="post-metadata">

**Author:** ![bmurphy](https://avatars.discourse-cdn.com/v4/letter/b/f19dbf/32.png) [@bmurphy](https://forum.suricata.io/u/bmurphy)\
**Post date:** [October 30, 2023, 1:40pm UTC](https://forum.suricata.io/t/suricata-rules-http-header-not-working/4120/3 "2023-10-30T13:40:20Z")

</div>

This might be related to this issue - [Bug #6415: Suricata not populating http.header, http.header.raw and http.request\_header buffers when malformed header value exists - Suricata - Open Information Security Foundation](https://redmine.openinfosecfoundation.org/issues/6415)

I think, though i’m not 100% sure, but it kinda looks like libhtp is considering anything that isn’t exactly “chunked” (case insensitive) to be invalid.

> <https://github.com/OISF/libhtp/blob/0.5.x/htp/htp_transaction.c#L408>

> <https://github.com/OISF/libhtp/blob/0.5.x/htp/bstr.c#L217-L221>

> <https://github.com/OISF/libhtp/blob/0.5.x/htp/bstr.c#L374-L400>

---

<div class="post-metadata">

**Author:** ![gosudvtnews](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/gosudvtnews/32/2458_2.png) [@gosudvtnews](https://forum.suricata.io/u/gosudvtnews)\
**Post date:** [October 31, 2023, 1:28am UTC](https://forum.suricata.io/t/suricata-rules-http-header-not-working/4120/4 "2023-10-31T01:28:00Z")

</div>

I try with listening live on the device interface ens33 and sending request via burpsuite but no alrert throw, when i remove http.header the rule was trigger