bug #496 - don't warn about offset/depth for packet sigs

diff --git a/src/detect-engine-analyzer.c b/src/detect-engine-analyzer.c
index 3a9f343ae41d11e867f4c93fb8b6b1e951eb452c..d802cbc6e4c4c7b93810adc822d48de5b58fa06a 100644 (file)
--- a/src/detect-engine-analyzer.c
+++ b/src/detect-engine-analyzer.c
@@ -514,7 +514,7 @@ void EngineAnalysisRules(Signature *s, char *line)
                                && (rule_pcre > 0 || rule_pcre_http > 0)*/) {
             fprintf(rule_engine_analysis_FD, "    Warning: Rule uses pcre with only a http_method content; possible performance issue.\n");
         }
-        if (rule_content_offset_depth > 0) {
+        if (rule_content_offset_depth > 0 && s->flags & SIG_FLAG_REQUIRE_STREAM) {
             fprintf(rule_engine_analysis_FD, "    Warning: Rule has depth"
                     "/offset with raw content keywords.  Please note the "
                     "offset/depth will be checked against both packet "