Bug #5076: keyword content does not work over reassembled TCP
keyword content does not work over reassembled TCP (6.0.x backport)
alert ip any any -> any any (content:"HTTP/2.loc"; sid:11;)
on attached pcap
does not trigger an alert
It does trigger the alert without the setting.
I fear we might have an evasion if I split the packets over the default value of 2560...