From 09342edaa929ab2aecfc0384e3fd5cea8c30d8dd Mon Sep 17 00:00:00 2001 From: Sujala Vasanthasena Nelavai Date: Sun, 24 May 2026 21:22:30 +0100 Subject: [PATCH] docs: clarify HTTP/2 frame transaction behaviour and restore stream ID 0 explanation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Improved the HTTP/2 documentation by adding a clarification note distinguishing HTTP/2 protocol frames from Suricata’s internal frame concept. Restored the original explanation for frames with stream ID 0, as this behaviour is correct: connection‑level frames (stream ID 0) result in a transaction being created for each frame, while other frames are grouped into transactions based on their stream identifier. No functional changes; documentation only. --- doc/userguide/rules/http2-keywords.rst | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/doc/userguide/rules/http2-keywords.rst b/doc/userguide/rules/http2-keywords.rst index 3152f09bd1..231f481e26 100644 --- a/doc/userguide/rules/http2-keywords.rst +++ b/doc/userguide/rules/http2-keywords.rst @@ -11,8 +11,10 @@ HTTP2 Keywords internal *frame* concept used in the rule language. HTTP/2 frames are grouped into transactions based on their stream -identifier. Frames with a stream ID of 0 are connection‑level frames -and are not part of a transaction. +identifier. + +Frames with a stream ID of 0, whose effects are global for the +connection, result in a transaction being created for each frame.