# What is Causing Hex Dump to STD Out?

**URL:** <https://forum.suricata.io/t/what-is-causing-hex-dump-to-std-out/6071>\
**Category:** Uncategorized\
**Created:** [October 21, 2025, 1:44pm UTC](https://forum.suricata.io/t/what-is-causing-hex-dump-to-std-out/6071 "2025-10-21T13:44:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![psander240](https://avatars.discourse-cdn.com/v4/letter/p/b5ac83/32.png) [@psander240](https://forum.suricata.io/u/psander240)\
**Post date:** [October 21, 2025, 1:44pm UTC](https://forum.suricata.io/t/what-is-causing-hex-dump-to-std-out/6071/1 "2025-10-21T13:44:28Z")

</div>

I’m seeing this output in the terminal I invoke Suricata from:

6f20lx 41 3d 71 f1 f9 40 ac 19 0c 90 e4 f2 16 d7 bb 73 |

6f30lx ac 10 69 10 23 60 67 0e 40 d8 8b 0b 9c 30 61 80 |..i.#`g.@…0a.|

6f40lx 28 06 31 f4 9c 24 70 b0 04 e3 1c d6 e0 2b 64 bd |(.1..$p…+d.|

6f50lx dd 45 90 d1 3e 08 98 cf 22 ec b1 df 72 bc 9a c9 |.E..\>…"…r…|

6f60lx f9 96 d5 7e 3d 07 42 47 9d 7b 69 9b 5a d7 1d 52 |…~=.BG.{i.Z..R|

6f70lx fd 74 35 f7 a6 2b be 28 21 9b b8 2c 4d b1 26 3f |.t5..+.(!..,M.&?|

6f80lx 6e 2c 87 cf 49 e4 9f 17 a7 1b ae 16 6b 4b db bf |n,..I…kK..|

6f90lx a6 76 f4 ae 37 f0 d8 0c f8 06 48 c3 a8 ca f6 05 |.v..7…H…|

6fa0lx af fb f0 02 33 55 4f 66 93 2e 40 90 a3 e9 16 8b |…3UOf..@…|

6fb0lx db 87 c7 a7 de 60 30 e1 a5 ef 47 e6 8b 5d 54 49 |…`0…G..]TI|

6fc0lx 08 07 10 68 bf 1e 75 ff 4e e0 4f 87 45 9d 28 01 |…h..u.N.O.E.(.|

6fd0lx 95 58 bf 7a e2 ff 38 f4 99 18 45 a3 74 90 da 21 |.X.z..8…E.t..!|

6fe0lx ca a9 0e 2c |…,|

htp\_connp\_res\_data: returning HTP\_STREAM\_DATA

htp\_connp\_req\_data(connp-\>in\_status 2)

htp\_connp\_req\_data: ptr NULL len 0

htp\_connp\_req\_data: in state=REQ\_IDLE, progress=NULL

htp\_connp\_req\_data: returning HTP\_STREAM\_DATA

htp\_connp\_res\_data(connp-\>out\_status 2)

htp\_connp\_res\_data: ptr NULL len 0

htp\_connp\_res\_data: out state=RES\_BODY\_IDENTITY\_CL\_KNOWN, progress=RES\_BODY

htp\_tx\_res\_process\_body\_data\_ex: ptr NULL len 0

htp\_connp\_res\_data: out state=RES\_BODY\_FINALIZE, progress=RES\_BODY

PROBING response finalize: ptr NULL len 0

htp\_tx\_res\_process\_body\_data\_ex: ptr NULL len 0

htp\_connp\_res\_data: out state=RES\_IDLE, progress=NULL

htp\_connp\_res\_data: returning HTP\_STREAM\_DATA

---

<div class="post-metadata">

**Author:** ![ish](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ish/32/8_2.png) [@ish](https://forum.suricata.io/u/ish)\
**Post date:** [October 21, 2025, 1:49pm UTC](https://forum.suricata.io/t/what-is-causing-hex-dump-to-std-out/6071/2 "2025-10-21T13:49:13Z")

</div>

> [@psander240](#):
>
> htp\_connp\_res\_data: returning HTP\_STREAM\_DATA

This will happen when Suricata is compiled with `–enable-debug`, or more specific libhtp. There are some printf’s guarded by `#ifdef HTP_DEBUG` that can print a lot of data when debug is enabled.

---

<div class="post-metadata">

**Author:** ![psander240](https://avatars.discourse-cdn.com/v4/letter/p/b5ac83/32.png) [@psander240](https://forum.suricata.io/u/psander240)\
**Post date:** [October 21, 2025, 2:10pm UTC](https://forum.suricata.io/t/what-is-causing-hex-dump-to-std-out/6071/3 "2025-10-21T14:10:38Z")

</div>

Thanks for the quick reply Jason! I’ll recompile without the -enable-debug option.

Pete