diff --git a/doc/userguide/rules/payload-keywords.rst b/doc/userguide/rules/payload-keywords.rst
index d6a3c5c40e..60f4133258 100644
--- a/doc/userguide/rules/payload-keywords.rst
+++ b/doc/userguide/rules/payload-keywords.rst
@@ -898,7 +898,8 @@ Example of the rpc keyword in a rule:
 replace
 -------
 
-The replace content modifier can only be used in IPS. It adjusts
+The replace content modifier can only be used in IPS. It is supported
+with NFQ, IPFW and DPDK (``copy-mode: ips``). It adjusts
 network traffic.  It changes the content it follows ('abc') into
 another ('def'), see example:
 
diff --git a/src/detect-replace.c b/src/detect-replace.c
index 7fc23e20e2..2b18465a58 100644
--- a/src/detect-replace.c
+++ b/src/detect-replace.c
@@ -27,6 +27,7 @@
  */
 
 #include "suricata-common.h"
+#include "suricata.h"
 
 #include "runmodes.h"
 
@@ -94,6 +95,11 @@ int DetectReplaceSetup(DetectEngineCtx *de_ctx, Signature *s, const char *replac
         case RUNMODE_NFQ:
         case RUNMODE_IPFW:
             break;
+        case RUNMODE_DPDK:
+            if (EngineModeIsIPS()) {
+                break;
+            }
+            // fall through
         default:
             SCLogWarning("Can't use 'replace' keyword in non IPS mode: %s", s->sig_str);
             /* this is a success, having the alert is interesting */