Suricata

Hi,

Im restart my Suricata (v1.2.1 and 1.3git) testing and Im found strange results with these sigs not fire:

alert tcp any any -> any 80 (msg:"FN suricata"; flow:to_server,established; isdataat:1; classtype:web-application-activity; sid:90011667; rev:1;)

alert tcp any any -> any 80 (msg:"FN suricata"; flow:to_server,established; pcre:"/^[^\n]{5}/P"; classtype:web-application-activity; sid:90011668; rev:1;)

alert tcp any any -> any 80 (msg:"FN suricata"; flow:to_server,established; content:"galid"; nocase; http_client_body; classtype:web-application-activity; sid:90011669; rev:1;)

Tested with these two http commands:
wget http://192.168.1.1/abcd.php --post-data="galid=abcdzad&dzadzza=dzadzdza"
curl http://192.168.1.1/abcd.php --data "galid=abcdzad&dzadzza=dzadzdza"

Joigned my two pcap for replaying.
No suricata error.
Disabled cksum validation.

Im sure Im totaly wrong but if someone check/confirm please ?
Of course, snort always fire.
Regards
Rmkml