Suricata

Hi,

1)Im test this rule work correctly:
alert any any > any 80 (msg:"test1"; flow:to_server,established; content:"hear"; within:4; distance:0; http_cookie; ...
my network traffic contains:
GET ....
Cookie: hear...
> ok

2)If I change to within:3
Suricata stop with error: good!

3)ok I move to depth/offset fire:
alert any any -> any 80 (msg:"test3"; flow:to_server,established; content:"hear"; depth:4; offset:0; http_cookie; ...

4)another test fire but no error, why? : (reduced depth value)
alert any any -> any 80 (msg:"test4"; flow:to_server,established; content:"hear"; depth:3; offset:0; http_cookie; ...

Regards
Rmkml