# There is no HTTP response header in alert sometimes **URL:** \ **Category:** Developers\ **Tags:** suricata\ **Created:** [September 27, 2023, 3:48am UTC](https://forum.suricata.io/t/there-is-no-http-response-header-in-alert-sometimes/3968 "2023-09-27T03:48:32Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![peter\_liu](https://avatars.discourse-cdn.com/v4/letter/p/9fc348/32.png) [@peter\_liu](https://forum.suricata.io/u/peter_liu)\ **Post date:** [September 27, 2023, 3:48am UTC](https://forum.suricata.io/t/there-is-no-http-response-header-in-alert-sometimes/3968/1 "2023-09-27T03:48:32Z")
Dear, I hope can get both HTTP request & respnse header when HTTP alert was triggered. When I tried some pcap, there is no HTTP response header in Alert info when my rule matched HTTP request header sometimes. Seems not received response header when alert generated according below log. My questions: 1, Can I resolve this problem through configuration file? 2, If (1) can’t , how can change code to meet this requirement? My compile cmd: ./configure --enable-unix-socket --enable-rust=yes --enable-dpdk (ignore the path setting) make && make install pcap and configuration were uploaded. suricata version: 7.0.1 run command: ./suricata -D -v --dpdk -c suricataV2.yaml Thanks in advance! [sid3232032.pcap](https://forum.suricata.io/uploads/short-url/jQYH9trFnq9az59OFYhu1WhN1GF.pcap) (292.8 KB) [suricataV2.yaml](https://forum.suricata.io/uploads/short-url/1yTwXiO3evYNAocDAdIAxg44BVP.yaml) (83.2 KB) [509739 - W#04-07:00.1] 2023-09-26 14:13:35 Notice: output-json-alert: Peter: Enter AlertJson p-\>alerts.cnt = 5 [509739 - W#04-07:00.1] 2023-09-26 14:13:35 Info: output-json-http: Peter: EveHttpAddMetadata tx = 0x7f5f8c4344f0, tx\_id = 0 store\_tx\_id = 0 [509739 - W#04-07:00.1] 2023-09-26 14:13:35 Info: output-json-http: Peter: EveHttpLogJSONHeaderBase64 htud-\>request\_headers\_raw\_len:853 [509739 - W#04-07:00.1] 2023-09-26 14:13:35 Info: output-json-http: Peter: EveHttpLogJSONHeaderBase64 htud-\>response\_headers\_raw\_len:0 [509739 - W#04-07:00.1] 2023-09-26 14:13:35 Info: output-json-http: Peter: EveHttpAddMetadata tx = 0x7f5f8c4344f0, tx\_id = 0 store\_tx\_id = 0 [509739 - W#04-07:00.1] 2023-09-26 14:13:35 Info: output-json-http: Peter: EveHttpLogJSONHeaderBase64 htud-\>request\_headers\_raw\_len:853 [509739 - W#04-07:00.1] 2023-09-26 14:13:35 Info: output-json-http: Peter: EveHttpLogJSONHeaderBase64 htud-\>response\_headers\_raw\_len:0 [509739 - W#04-07:00.1] 2023-09-26 14:13:35 Info: output-json-http: Peter: EveHttpAddMetadata tx = 0x7f5f8c4344f0, tx\_id = 0 store\_tx\_id = 0 [509739 - W#04-07:00.1] 2023-09-26 14:13:35 Info: output-json-http: Peter: EveHttpLogJSONHeaderBase64 htud-\>request\_headers\_raw\_len:853 [509739 - W#04-07:00.1] 2023-09-26 14:13:35 Info: output-json-http: Peter: EveHttpLogJSONHeaderBase64 htud-\>response\_headers\_raw\_len:0 [509739 - W#04-07:00.1] 2023-09-26 14:13:35 Info: output-json-http: Peter: EveHttpAddMetadata tx = 0x7f5f8c4344f0, tx\_id = 0 store\_tx\_id = 0 [509739 - W#04-07:00.1] 2023-09-26 14:13:35 Info: output-json-http: Peter: EveHttpLogJSONHeaderBase64 htud-\>request\_headers\_raw\_len:853 [509739 - W#04-07:00.1] 2023-09-26 14:13:35 Info: output-json-http: Peter: EveHttpLogJSONHeaderBase64 htud-\>response\_headers\_raw\_len:0 [509739 - W#04-07:00.1] 2023-09-26 14:13:35 Info: output-json-http: Peter: EveHttpAddMetadata tx = 0x7f5f8c4344f0, tx\_id = 0 store\_tx\_id = 0 [509739 - W#04-07:00.1] 2023-09-26 14:13:35 Info: output-json-http: Peter: EveHttpLogJSONHeaderBase64 htud-\>request\_headers\_raw\_len:853 [509739 - W#04-07:00.1] 2023-09-26 14:13:35 Info: output-json-http: Peter: EveHttpLogJSONHeaderBase64 htud-\>response\_headers\_raw\_len:0 [509739 - W#04-07:00.1] 2023-09-26 14:13:35 Info: app-layer-htp: HTPCallbackRequestComplete Enter [509739 - W#04-07:00.1] 2023-09-26 14:13:35 Info: app-layer-htp: HTPCallbackRequestComplete transaction\_cnt 0, list\_size 1, hstate-\>curr\_tx\_id 0 [509739 - W#04-07:00.1] 2023-09-26 14:13:35 Info: app-layer-htp: HTPCallbackRequestComplete HTTP request completed [509739 - W#04-07:00.1] 2023-09-26 14:13:35 Info: app-layer-htp: Peter: exit HTPCallbackResponseHeaderData… response\_headers\_raw\_len = 257 [509739 - W#04-07:00.1] 2023-09-26 14:13:35 Info: app-layer-htp: Peter: exit HTPCallbackResponseHeaderData… response\_headers\_raw\_len = 259 ---
**Author:** ![sbhardwaj](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/sbhardwaj/32/10_2.png) [@sbhardwaj](https://forum.suricata.io/u/sbhardwaj)\ **Post date:** [October 3, 2023, 10:56am UTC](https://forum.suricata.io/t/there-is-no-http-response-header-in-alert-sometimes/3968/2 "2023-10-03T10:56:51Z")
Hi @peter_liu ! Welcome to our forum! 🙂 > When I tried some pcap, there is no HTTP response header in Alert info when my rule matched HTTP request header sometimes This happens because the alert is processed right when a match is made and the response may have not been parsed yet. In order to get the corresponding response info, you can either: 1. correlate the flow\_id of the alert and the http event to get the response info from the http event. 2. set flowbits on the transaction such that the alert only happens when the response is also seen. See [8.11. Flow Keywords — Suricata 8.0.0-dev documentation](https://docs.suricata.io/en/latest/rules/flow-keywords.html?highlight=flowbit#flowbits)