Thanks, but it doesn't help (still scans 0 data bytes). On Wed, 13 Sep 2017 10:33:35 -0400 Steven Morgan <smorgan at sourcefire.com> wrote: > Paul, > > in addition to max-filesize, try max-scansize. > > Steve >