# Threshold rule without tracking by source or destination **URL:** \ **Category:** Rules\ **Tags:** suricata\ **Created:** [November 17, 2022, 5:26pm UTC](https://forum.suricata.io/t/threshold-rule-without-tracking-by-source-or-destination/2988 "2022-11-17T17:26:28Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![noob\_17](https://avatars.discourse-cdn.com/v4/letter/n/839c29/32.png) [@noob\_17](https://forum.suricata.io/u/noob_17)\ **Post date:** [November 17, 2022, 5:26pm UTC](https://forum.suricata.io/t/threshold-rule-without-tracking-by-source-or-destination/2988/1 "2022-11-17T17:26:28Z")
Hello, Is it possible to threshold a specific rule without specifying the `track_by src | dst` field? Thanks. ---
**Author:** ![IDSTower](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/idstower/32/861_2.png) [@IDSTower](https://forum.suricata.io/u/IDSTower)\ **Post date:** [November 17, 2022, 6:01pm UTC](https://forum.suricata.io/t/threshold-rule-without-tracking-by-source-or-destination/2988/2 "2022-11-17T18:01:45Z")
Yes, use “track by\_rule” [https://suricata.readthedocs.io/en/suricata-6.0.0/rules/thresholding.html](https://suricata.readthedocs.io/en/suricata-6.0.0/rules/thresholding.html) ---
**Author:** ![noob\_17](https://avatars.discourse-cdn.com/v4/letter/n/839c29/32.png) [@noob\_17](https://forum.suricata.io/u/noob_17)\ **Post date:** [November 21, 2022, 11:23am UTC](https://forum.suricata.io/t/threshold-rule-without-tracking-by-source-or-destination/2988/3 "2022-11-21T11:23:34Z")
But i can´t use that syntax in the global threshold.config file, right? ---
**Author:** ![IDSTower](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/idstower/32/861_2.png) [@IDSTower](https://forum.suricata.io/u/IDSTower)\ **Post date:** [November 21, 2022, 11:35am UTC](https://forum.suricata.io/t/threshold-rule-without-tracking-by-source-or-destination/2988/4 "2022-11-21T11:35:28Z")
The docs says you actually can, however the syntax in threshold.conf might be slightly different Take a look here: [10.2. Global-Thresholds — Suricata 6.0.0 documentation](https://suricata.readthedocs.io/en/suricata-6.0.0/configuration/global-thresholds.html) ---
**Author:** ![noob\_17](https://avatars.discourse-cdn.com/v4/letter/n/839c29/32.png) [@noob\_17](https://forum.suricata.io/u/noob_17)\ **Post date:** [November 21, 2022, 11:36am UTC](https://forum.suricata.io/t/threshold-rule-without-tracking-by-source-or-destination/2988/5 "2022-11-21T11:36:38Z")
I am getting this error: `21/11/2022 -- 11:33:57 - - [ERRCODE: SC_ERR_PCRE_MATCH(2)] - pcre_exec parse error, ret -1, string , type limit, track by_rule, count 5, seconds 300` Rule is looking like this: `threshold gen_id 1, sig_id 2010935, type limit, track by_rule, count 5, seconds 300` ---
**Author:** ![noob\_17](https://avatars.discourse-cdn.com/v4/letter/n/839c29/32.png) [@noob\_17](https://forum.suricata.io/u/noob_17)\ **Post date:** [November 21, 2022, 12:13pm UTC](https://forum.suricata.io/t/threshold-rule-without-tracking-by-source-or-destination/2988/6 "2022-11-21T12:13:24Z")
Seems to be a bug in the latest version. In the beta version seems to be resolved. Is it possible to resolve in the stable version? ---
**Author:** ![IDSTower](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/idstower/32/861_2.png) [@IDSTower](https://forum.suricata.io/u/IDSTower)\ **Post date:** [November 21, 2022, 4:00pm UTC](https://forum.suricata.io/t/threshold-rule-without-tracking-by-source-or-destination/2988/7 "2022-11-21T16:00:00Z")
If by beta version you mean version 7, this will be promoted to stable probably in the coming months ---
**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\ **Post date:** [November 22, 2022, 10:53am UTC](https://forum.suricata.io/t/threshold-rule-without-tracking-by-source-or-destination/2988/8 "2022-11-22T10:53:08Z")
What version are you running exactly? Can you output `suricata --build-info`? If it’s a real bug in 6.0.8 it’s still the stable and supported branch and changes are high that it would be fixed there as well. But first it needs to be verified. ---
**Author:** ![noob\_17](https://avatars.discourse-cdn.com/v4/letter/n/839c29/32.png) [@noob\_17](https://forum.suricata.io/u/noob_17)\ **Post date:** [November 22, 2022, 10:59am UTC](https://forum.suricata.io/t/threshold-rule-without-tracking-by-source-or-destination/2988/9 "2022-11-22T10:59:03Z")
Now i am running the 7.0.0-beta. Installed 5 minutes ago and the issue seems to be gone, without changing anything in the rule. Error is gone. I was using the 6.0.8 version ---
**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\ **Post date:** [November 22, 2022, 11:03am UTC](https://forum.suricata.io/t/threshold-rule-without-tracking-by-source-or-destination/2988/10 "2022-11-22T11:03:21Z")
Please post the config file and how you run it with 6.0.8 so we can verify that it’s an actual bug in 6.0.8 ---
**Author:** ![noob\_17](https://avatars.discourse-cdn.com/v4/letter/n/839c29/32.png) [@noob\_17](https://forum.suricata.io/u/noob_17)\ **Post date:** [November 22, 2022, 11:40am UTC](https://forum.suricata.io/t/threshold-rule-without-tracking-by-source-or-destination/2988/11 "2022-11-22T11:40:26Z")
The suricata.yaml? Can i send it to you via private message? ---
**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\ **Post date:** [November 22, 2022, 11:42am UTC](https://forum.suricata.io/t/threshold-rule-without-tracking-by-source-or-destination/2988/12 "2022-11-22T11:42:45Z")
You can remove sensitive parts and post it here, so others can try to help as well. ---
**Author:** ![noob\_17](https://avatars.discourse-cdn.com/v4/letter/n/839c29/32.png) [@noob\_17](https://forum.suricata.io/u/noob_17)\ **Post date:** [November 22, 2022, 11:54am UTC](https://forum.suricata.io/t/threshold-rule-without-tracking-by-source-or-destination/2988/13 "2022-11-22T11:54:19Z")
[suricata.yaml](https://forum.suricata.io/uploads/short-url/uQMcLCrE8isYFSrsz0MlrQJFUcC.yaml) (74.3 KB) Here it is