Suricata

Hello Suricata maintainers,

I am reporting a repeatable detection-behavior difference from a local offline NIDS study and asking whether this is expected. This is not an assertion of a vulnerability or production impact.

The attached package groups several frozen synthetic IPv4/TCP/HTTP cases and rules (including SIDs 24137, 18073, 24136, and 1079). In the observed cases, the packet endpoints fell outside the address sets selected by the rule header. Instrumented local runs recorded source_match=0 and/or destination_match=0 at the rule-header check. A controlled comparison changed only the registered endpoint predicates while keeping content conditions, PCRE, and rule groups fixed; Suricata then changed from no alert to alert for the cases with completed comparisons. This points to the address/header eligibility gate as a possible contributor, but not every candidate in the bundle has a complete causal comparison.

Could you confirm whether these results are expected for the documented rule address variables and configuration, and whether any of the complete cases would be appropriate for a Suricata-Verify regression test? The report is limited to the listed synthetic inputs and tested configuration; it does not claim a product vulnerability or general network impact.

Reproduction environment: local offline synthetic NIDS testing only, with no live network, production deployment, or third-party target. The attached ZIP contains the relevant PCAPs, rules/configuration, case notes, and recorded runtime identity/hashes. Experiments are from prior recorded runs; the package has not been independently replayed since staging. Some candidates are explicitly partial, as noted in the bundle.

Thank you.