# There is no HTTP response header in alert sometimes

**URL:** <https://forum.suricata.io/t/there-is-no-http-response-header-in-alert-sometimes/3968>\
**Category:** Developers\
**Tags:** suricata\
**Created:** [September 27, 2023, 3:48am UTC](https://forum.suricata.io/t/there-is-no-http-response-header-in-alert-sometimes/3968 "2023-09-27T03:48:32Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![sbhardwaj](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/sbhardwaj/32/10_2.png) [@sbhardwaj](https://forum.suricata.io/u/sbhardwaj)\
**Post date:** [October 3, 2023, 10:56am UTC](https://forum.suricata.io/t/there-is-no-http-response-header-in-alert-sometimes/3968/2 "2023-10-03T10:56:51Z")

</div>

Hi @peter_liu !  
Welcome to our forum! 🙂

> When I tried some pcap, there is no HTTP response header in Alert info when my rule matched HTTP request header sometimes

This happens because the alert is processed right when a match is made and the response may have not been parsed yet.  
In order to get the corresponding response info, you can either:

1. correlate the flow\_id of the alert and the http event to get the response info from the http event.
2. set flowbits on the transaction such that the alert only happens when the response is also seen. See [8.11. Flow Keywords — Suricata 8.0.0-dev documentation](https://docs.suricata.io/en/latest/rules/flow-keywords.html?highlight=flowbit#flowbits)

---

_[View the full topic](https://forum.suricata.io/t/there-is-no-http-response-header-in-alert-sometimes/3968)._