# Transformation keyword can't trigger an alert

**URL:** <https://forum.suricata.io/t/transformation-keyword-cant-trigger-an-alert/881>\
**Category:** Rules\
**Created:** [December 4, 2020, 6:59am UTC](https://forum.suricata.io/t/transformation-keyword-cant-trigger-an-alert/881 "2020-12-04T06:59:30Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yixuan\_Fang](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/yixuan_fang/32/277_2.png) [@Yixuan\_Fang](https://forum.suricata.io/u/Yixuan_Fang)\
**Post date:** [December 4, 2020, 6:59am UTC](https://forum.suricata.io/t/transformation-keyword-cant-trigger-an-alert/881/1 "2020-12-04T06:59:30Z")

</div>

I test the transformation keyword url\_decode by writing 2 rules. And I get an alert by only using rule2.  
However, if I using rule1 and rule2 together, then no alert occurs.

_rule1_:  
alert http any any -\> $HOME\_NET any (msg:“detecting (/etc/passwd)”; flow:to\_server,established; http.request\_body; content:"\\etc\\passwd")

_rule2_:  
alert http any any -\> $HOME\_NET any (msg:“detecting (/etc/passwd)”; flow:to\_server,established; http.request\_body; **url\_decode** ; content:"\\etc\\passwd")

I debug the detection part of the code and figuring out the workflow of transformation. If a rule file containing **rule1 detecting a sticky buffer** and **rule2 detecting the sticky buffer after transformation** , Suricata starts from inepecting the original sticky buffer. After this process, the sticky buffer would be flagged as “already inspected”. So transformation can’t be performed on this sticky buffer since it’s already taken and inspected. Therefore, _rule2_ can’t trigger any alert.

I wonder, if it’s a BUG of transformation. I can’t find any other useful information through the [documentation](https://suricata.readthedocs.io/en/suricata-6.0.0/rules/transforms.h).

---

<div class="post-metadata">

**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\
**Post date:** [December 4, 2020, 12:54pm UTC](https://forum.suricata.io/t/transformation-keyword-cant-trigger-an-alert/881/2 "2020-12-04T12:54:48Z")

</div>

You’re using Suricata versioin 6.0?

We made an update that should help with your situation; could you try with Suricata 6.0.1 (to be released within the next few days) and report back?

---

<div class="post-metadata">

**Author:** ![Yixuan\_Fang](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/yixuan_fang/32/277_2.png) [@Yixuan\_Fang](https://forum.suricata.io/u/Yixuan_Fang)\
**Post date:** [December 8, 2020, 6:18am UTC](https://forum.suricata.io/t/transformation-keyword-cant-trigger-an-alert/881/3 "2020-12-08T06:18:44Z")

</div>

Thanks for your reply. I update with Suricata 6.0.1 and I run the following two tests. But it seems like the problem has not been sovled.

1. Test 1

I use a rule file containing 2 rules:

alert http any any -\> $HOME\_NET any (msg:“detect (/etc/passwd)”; flow:to\_server,established; http.request\_body; **url\_decode;** content:"/etc/passwd"; nocase; sid:1001;)  
alert http any any -\> $HOME\_NET any (msg:“detect (/etc/passwd)”; flow:to\_server,established; http.request\_body; **url\_decode;** content:"/etc/passwd"; nocase; sid:1002;)

And I get **2 alerts**.

1. Test 2

I use a rule file containing 2 rules:  
alert http any any -\> $HOME\_NET any (msg:“detect (/etc/passwd)”; flow:to\_server,established; http.request\_body;content:"/etc/passwd"; nocase; sid:1001;)  
alert http any any -\> $HOME\_NET any (msg:“detect (/etc/passwd)”; flow:to\_server,established; http.request\_body; **url\_decode;** content:"/etc/passwd"; nocase; sid:1002;)

And I get **no alert**.

The test pcap file is attached here.  
[http.pcap](https://forum.suricata.io/uploads/short-url/9SUvIyPDwgP0YWV9QMTl9WmSsxX.pcap) (2.0 KB)

---

<div class="post-metadata">

**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\
**Post date:** [December 8, 2020, 2:46pm UTC](https://forum.suricata.io/t/transformation-keyword-cant-trigger-an-alert/881/4 "2020-12-08T14:46:27Z")

</div>

Hi,

We’ve created an issue to track the problem that you’ve found: [https://redmine.openinfosecfoundation.org/issues/4210](https://redmine.openinfosecfoundation.org/issues/4210)