diff --git a/src/detect-engine-sigorder.c b/src/detect-engine-sigorder.c index a44c3e2cc9..3c668c8631 100644 --- a/src/detect-engine-sigorder.c +++ b/src/detect-engine-sigorder.c @@ -129,6 +129,17 @@ static inline int SCSigGetFlowbitsType(Signature *sig) sm = sm->next; } + sm = sig->sm_lists[DETECT_SM_LIST_POSTMATCH]; + while (sm != NULL) { + if (sm->type == DETECT_FLOWBITS) { + fb = (DetectFlowbitsData *)sm->ctx; + if (flowbits > fb->cmd) + flowbits = fb->cmd; + } + + sm = sm->next; + } + if (flowbits == DETECT_FLOWBITS_CMD_SET || flowbits == DETECT_FLOWBITS_CMD_UNSET || flowbits == DETECT_FLOWBITS_CMD_TOGGLE) {