diff --git a/rust/htp/src/transaction.rs b/rust/htp/src/transaction.rs
index b44a82d86a..0a37573b8e 100644
--- a/rust/htp/src/transaction.rs
+++ b/rust/htp/src/transaction.rs
@@ -973,17 +973,18 @@ pub(crate) fn xff_ip(reversed: bool, h_xff: &[u8], dst: &mut [u8]) -> bool {
         let cut = h_xff
             .iter()
             .rev()
-            .position(|&c| c == b' ')
+            .position(|&c| c == b' ' || c == b',')
             .unwrap_or(h_xff.len());
         &h_xff[h_xff.len() - cut..]
     } else {
         /* Get the first IP address from the chain */
         let cut = h_xff
             .iter()
-            .position(|&c| c == b',')
+            .position(|&c| c == b' ' || c == b',')
             .unwrap_or(h_xff.len());
         &h_xff[..cut]
     };
+    let ipbuf = ipbuf.trim_ascii();
     parse_xff_string(ipbuf, dst)
 }
 
@@ -1118,4 +1119,19 @@ fn test_xff_ip() {
 
     let mut too_short = [0u8; 4];
     assert!(!xff_ip(true, b"1.2.3.4", &mut too_short));
-}
\ No newline at end of file
+
+    assert!(xff_ip(true, b"1.1.1.1,2.2.2.2", &mut dst));
+    assert_eq!(&dst[..8], b"2.2.2.2\0");
+    assert!(xff_ip(false, b"1.1.1.1,2.2.2.2", &mut dst));
+    assert_eq!(&dst[..8], b"1.1.1.1\0");
+
+    assert!(xff_ip(true, b"1.1.1.1 , 2.2.2.2", &mut dst));
+    assert_eq!(&dst[..8], b"2.2.2.2\0");
+    assert!(xff_ip(false, b"1.1.1.1 , 2.2.2.2", &mut dst));
+    assert_eq!(&dst[..8], b"1.1.1.1\0");
+    assert!(xff_ip(false, b"1.1.1.1 2.2.2.2", &mut dst));
+    assert_eq!(&dst[..8], b"1.1.1.1\0");
+    assert!(xff_ip(false, b"1.1.1.1 junk", &mut dst));
+    assert_eq!(&dst[..8], b"1.1.1.1\0");
+    assert!(!xff_ip(true, b"1.1.1.1 junk", &mut dst));
+}