diff --git a/src/detect.c b/src/detect.c index 03fa8437068d..3863b7f9a403 100644 --- a/src/detect.c +++ b/src/detect.c @@ -814,9 +814,11 @@ static inline void DetectRulePacketRules( uint64_t txid = PACKET_ALERT_NOTX; if ((alert_flags & PACKET_ALERT_FLAG_STREAM_MATCH) || - (s->alproto != ALPROTO_UNKNOWN && pflow->proto == IPPROTO_UDP)) { + (s->alproto != ALPROTO_UNKNOWN && pflow->proto == IPPROTO_UDP) || + AppLayerParserGetTxCnt(pflow, pflow->alstate) == 1) { // if there is a stream match (TCP), or // a UDP specific app-layer signature, + // or only one transaction // try to use the good tx for the packet direction if (pflow->alstate) { uint8_t dir =