diff --git a/doc/userguide/rules/multi-buffer-matching.rst b/doc/userguide/rules/multi-buffer-matching.rst
index 8055d58dff..6102aad91e 100644
--- a/doc/userguide/rules/multi-buffer-matching.rst
+++ b/doc/userguide/rules/multi-buffer-matching.rst
@@ -126,3 +126,6 @@ following keywords:
 * ``tls.alpn``
 * ``tls.certs``
 * ``tls.subjectaltname``
+
+These can be found by command
+``suricata --list-keywords=csv | grep "multi buffer" | cut -d';' -f1``
\ No newline at end of file
diff --git a/rust/cbindgen.toml b/rust/cbindgen.toml
index 14580e6485..83d5f79973 100644
--- a/rust/cbindgen.toml
+++ b/rust/cbindgen.toml
@@ -118,6 +118,7 @@ exclude = [
     "SRepCatGetByShortname",
     "SIGMATCH_NOOPT",
     "SIGMATCH_INFO_STICKY_BUFFER",
+    "SIGMATCH_INFO_MULTI_BUFFER",
     "FtpCommand",
 ]
 
diff --git a/rust/src/detect/mod.rs b/rust/src/detect/mod.rs
index 9ca6d426fc..d74c5c5a0f 100644
--- a/rust/src/detect/mod.rs
+++ b/rust/src/detect/mod.rs
@@ -74,7 +74,7 @@ pub struct SigTableElmtStickyBuffer {
     ) -> c_int,
 }
 
-pub fn helper_keyword_register_sticky_buffer(kw: &SigTableElmtStickyBuffer) -> u16 {
+fn helper_keyword_register_buffer_flags(kw: &SigTableElmtStickyBuffer, flags: u16) -> u16 {
     let name = CString::new(kw.name.as_bytes()).unwrap().into_raw();
     let desc = CString::new(kw.desc.as_bytes()).unwrap().into_raw();
     let url = CString::new(kw.url.as_bytes()).unwrap().into_raw();
@@ -83,7 +83,7 @@ pub fn helper_keyword_register_sticky_buffer(kw: &SigTableElmtStickyBuffer) -> u
         desc,
         url,
         Setup: Some(kw.setup),
-        flags: SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER,
+        flags,
         AppLayerTxMatch: None,
         Free: None,
     };
@@ -94,6 +94,17 @@ pub fn helper_keyword_register_sticky_buffer(kw: &SigTableElmtStickyBuffer) -> u
     }
 }
 
+pub fn helper_keyword_register_multi_buffer(kw: &SigTableElmtStickyBuffer) -> u16 {
+    return helper_keyword_register_buffer_flags(
+        kw,
+        SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER,
+    );
+}
+
+pub fn helper_keyword_register_sticky_buffer(kw: &SigTableElmtStickyBuffer) -> u16 {
+    return helper_keyword_register_buffer_flags(kw, SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER);
+}
+
 #[repr(C)]
 #[allow(non_snake_case)]
 /// Names of SigTableElmt for release by rust
@@ -118,6 +129,7 @@ pub const SIGMATCH_NOOPT: u16 = 1; // BIT_U16(0) in detect.h
 pub(crate) const SIGMATCH_OPTIONAL_OPT: u16 = 0x10; // BIT_U16(4) in detect.h
 pub(crate) const SIGMATCH_QUOTES_MANDATORY: u16 = 0x40; // BIT_U16(6) in detect.h
 pub const SIGMATCH_INFO_STICKY_BUFFER: u16 = 0x200; // BIT_U16(9)
+pub const SIGMATCH_INFO_MULTI_BUFFER: u16 = 0x4000; // BIT_U16(14)
 
 #[repr(u8)]
 #[derive(Copy, Clone, Debug, PartialEq, Eq)]
diff --git a/rust/src/dns/detect.rs b/rust/src/dns/detect.rs
index 133ac324c3..691903e198 100644
--- a/rust/src/dns/detect.rs
+++ b/rust/src/dns/detect.rs
@@ -24,7 +24,7 @@ use crate::detect::uint::{
     detect_uint_match_at_index, DetectUintArrayData, DetectUintData, SCDetectU16Free,
     SCDetectU8Free, SCDetectU8Parse,
 };
-use crate::detect::{helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer};
+use crate::detect::{helper_keyword_register_multi_buffer, SigTableElmtStickyBuffer};
 use crate::direction::Direction;
 use std::ffi::CStr;
 use std::os::raw::{c_int, c_void};
@@ -358,7 +358,7 @@ pub unsafe extern "C" fn SCDetectDNSRegister() {
         url: String::from("/rules/dns-keywords.html#dns-answer-name"),
         setup: dns_detect_answer_name_setup,
     };
-    let _g_dns_answer_name_kw_id = helper_keyword_register_sticky_buffer(&kw);
+    let _g_dns_answer_name_kw_id = helper_keyword_register_multi_buffer(&kw);
     G_DNS_ANSWER_NAME_BUFFER_ID = SCDetectHelperMultiBufferProgressMpmRegister(
         b"dns.answer.name\0".as_ptr() as *const libc::c_char,
         b"dns answer name\0".as_ptr() as *const libc::c_char,
@@ -390,7 +390,7 @@ pub unsafe extern "C" fn SCDetectDNSRegister() {
         url: String::from("/rules/dns-keywords.html#dns-query-name"),
         setup: dns_detect_query_name_setup,
     };
-    let _g_dns_query_name_kw_id = helper_keyword_register_sticky_buffer(&kw);
+    let _g_dns_query_name_kw_id = helper_keyword_register_multi_buffer(&kw);
     G_DNS_QUERY_NAME_BUFFER_ID = SCDetectHelperMultiBufferProgressMpmRegister(
         b"dns.query.name\0".as_ptr() as *const libc::c_char,
         b"dns query name\0".as_ptr() as *const libc::c_char,
@@ -437,7 +437,7 @@ pub unsafe extern "C" fn SCDetectDNSRegister() {
         url: String::from("/rules/dns-keywords.html#dns-query"),
         setup: dns_detect_query_setup,
     };
-    let g_dns_query_name_kw_id = helper_keyword_register_sticky_buffer(&kw);
+    let g_dns_query_name_kw_id = helper_keyword_register_multi_buffer(&kw);
     SCDetectHelperKeywordAliasRegister(
         g_dns_query_name_kw_id,
         b"dns_query\0".as_ptr() as *const libc::c_char,
diff --git a/rust/src/ldap/detect.rs b/rust/src/ldap/detect.rs
index b313c42e05..bc95edbc92 100644
--- a/rust/src/ldap/detect.rs
+++ b/rust/src/ldap/detect.rs
@@ -22,7 +22,10 @@ use crate::detect::uint::{
     detect_uint_match_at_index, DetectUintArrayData, DetectUintData, SCDetectU32Free,
     SCDetectU32Parse, SCDetectU8Free,
 };
-use crate::detect::{helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer};
+use crate::detect::{
+    helper_keyword_register_multi_buffer, helper_keyword_register_sticky_buffer,
+    SigTableElmtStickyBuffer,
+};
 use crate::ldap::types::*;
 use ldap_parser::ldap::{LdapMessage, ProtocolOp};
 use suricata_sys::sys::{
@@ -575,7 +578,7 @@ pub unsafe extern "C" fn SCDetectLdapRegister() {
         url: String::from("/rules/ldap-keywords.html#ldap.responses.dn"),
         setup: ldap_detect_responses_dn_setup,
     };
-    let _g_ldap_responses_dn_kw_id = helper_keyword_register_sticky_buffer(&kw);
+    let _g_ldap_responses_dn_kw_id = helper_keyword_register_multi_buffer(&kw);
     G_LDAP_RESPONSES_DN_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
         b"ldap.responses.dn\0".as_ptr() as *const libc::c_char,
         b"LDAP RESPONSES DISTINGUISHED_NAME\0".as_ptr() as *const libc::c_char,
@@ -605,7 +608,7 @@ pub unsafe extern "C" fn SCDetectLdapRegister() {
         url: String::from("/rules/ldap-keywords.html#ldap.responses.message"),
         setup: ldap_detect_responses_msg_setup,
     };
-    let _g_ldap_responses_dn_kw_id = helper_keyword_register_sticky_buffer(&kw);
+    let _g_ldap_responses_dn_kw_id = helper_keyword_register_multi_buffer(&kw);
     G_LDAP_RESPONSES_MSG_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
         b"ldap.responses.message\0".as_ptr() as *const libc::c_char,
         b"LDAP RESPONSES DISTINGUISHED_NAME\0".as_ptr() as *const libc::c_char,
@@ -619,7 +622,7 @@ pub unsafe extern "C" fn SCDetectLdapRegister() {
         url: String::from("/rules/ldap-keywords.html#ldap.request.attribute_type"),
         setup: ldap_detect_request_attibute_type_setup,
     };
-    let _g_ldap_request_attribute_type_kw_id = helper_keyword_register_sticky_buffer(&kw);
+    let _g_ldap_request_attribute_type_kw_id = helper_keyword_register_multi_buffer(&kw);
     G_LDAP_REQUEST_ATTRIBUTE_TYPE_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
         b"ldap.request.attribute_type\0".as_ptr() as *const libc::c_char,
         b"LDAP REQUEST ATTRIBUTE TYPE\0".as_ptr() as *const libc::c_char,
@@ -633,7 +636,7 @@ pub unsafe extern "C" fn SCDetectLdapRegister() {
         url: String::from("/rules/ldap-keywords.html#ldap.responses.attribute_type"),
         setup: ldap_detect_responses_attibute_type_setup,
     };
-    let _g_ldap_responses_attribute_type_kw_id = helper_keyword_register_sticky_buffer(&kw);
+    let _g_ldap_responses_attribute_type_kw_id = helper_keyword_register_multi_buffer(&kw);
     G_LDAP_RESPONSES_ATTRIBUTE_TYPE_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
         b"ldap.responses.attribute_type\0".as_ptr() as *const libc::c_char,
         b"LDAP RESPONSES ATTRIBUTE TYPE\0".as_ptr() as *const libc::c_char,
diff --git a/rust/src/mqtt/detect.rs b/rust/src/mqtt/detect.rs
index 9fe7ba3f77..2282fe0ee2 100644
--- a/rust/src/mqtt/detect.rs
+++ b/rust/src/mqtt/detect.rs
@@ -22,7 +22,10 @@ use crate::detect::uint::{
     detect_match_uint, detect_parse_array_uint_enum, detect_parse_uint, detect_uint_match_at_index,
     DetectUintArrayData, DetectUintData, DetectUintMode, SCDetectU8Free, SCDetectU8Parse,
 };
-use crate::detect::{helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer};
+use crate::detect::{
+    helper_keyword_register_multi_buffer, helper_keyword_register_sticky_buffer,
+    SigTableElmtStickyBuffer,
+};
 use suricata_sys::sys::{
     DetectEngineCtx, DetectEngineThreadCtx, Flow, SCDetectBufferSetActiveList,
     SCDetectHelperBufferMpmRegister, SCDetectHelperBufferRegister, SCDetectHelperKeywordRegister,
@@ -992,7 +995,7 @@ pub unsafe extern "C" fn SCDetectMqttRegister() {
             SCLogError!("Invalid value for app-layer.protocols.mqtt.unsubscribe-topic-match-limit");
         }
     }
-    let _g_mqtt_unsub_topic_kw_id = helper_keyword_register_sticky_buffer(&kw);
+    let _g_mqtt_unsub_topic_kw_id = helper_keyword_register_multi_buffer(&kw);
     G_MQTT_UNSUB_TOPIC_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
         keyword_name,
         b"unsubscribe topic query\0".as_ptr() as *const libc::c_char,
@@ -1031,7 +1034,7 @@ pub unsafe extern "C" fn SCDetectMqttRegister() {
             SCLogError!("Invalid value for app-layer.protocols.mqtt.subscribe-topic-match-limit");
         }
     }
-    let _g_mqtt_sub_topic_kw_id = helper_keyword_register_sticky_buffer(&kw);
+    let _g_mqtt_sub_topic_kw_id = helper_keyword_register_multi_buffer(&kw);
     G_MQTT_SUB_TOPIC_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
         keyword_name,
         b"subscribe topic query\0".as_ptr() as *const libc::c_char,
diff --git a/rust/src/sdp/detect.rs b/rust/src/sdp/detect.rs
index 55159ceb15..9ba96d8206 100644
--- a/rust/src/sdp/detect.rs
+++ b/rust/src/sdp/detect.rs
@@ -18,7 +18,10 @@
 // written by Giuseppe Longo <giuseppe@glongo.it>
 
 use crate::core::{STREAM_TOCLIENT, STREAM_TOSERVER};
-use crate::detect::{helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer};
+use crate::detect::{
+    helper_keyword_register_multi_buffer, helper_keyword_register_sticky_buffer,
+    SigTableElmtStickyBuffer,
+};
 use crate::direction::Direction;
 use crate::sip::sip::{SIPTransaction, ALPROTO_SIP};
 use std::os::raw::{c_int, c_void};
@@ -740,7 +743,7 @@ pub unsafe extern "C" fn SCDetectSdpRegister() {
         url: String::from("/rules/sdp-keywords.html#sdp-bandwidth"),
         setup: sdp_bandwidth_setup,
     };
-    let _ = helper_keyword_register_sticky_buffer(&kw);
+    let _ = helper_keyword_register_multi_buffer(&kw);
     G_SDP_BANDWIDTH_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
         b"sdp.bandwidth\0".as_ptr() as *const libc::c_char,
         b"sdp.bandwidth\0".as_ptr() as *const libc::c_char,
@@ -754,7 +757,7 @@ pub unsafe extern "C" fn SCDetectSdpRegister() {
         url: String::from("/rules/sdp-keywords.html#time"),
         setup: sdp_time_setup,
     };
-    let _ = helper_keyword_register_sticky_buffer(&kw);
+    let _ = helper_keyword_register_multi_buffer(&kw);
     G_SDP_TIME_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
         b"sdp.time\0".as_ptr() as *const libc::c_char,
         b"sdp.time\0".as_ptr() as *const libc::c_char,
@@ -768,7 +771,7 @@ pub unsafe extern "C" fn SCDetectSdpRegister() {
         url: String::from("/rules/sdp-keywords.html#repeat-time"),
         setup: sdp_repeat_time_setup,
     };
-    let _ = helper_keyword_register_sticky_buffer(&kw);
+    let _ = helper_keyword_register_multi_buffer(&kw);
     G_SDP_REPEAT_TIME_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
         b"sdp.repeat_time\0".as_ptr() as *const libc::c_char,
         b"sdp.repeat_time\0".as_ptr() as *const libc::c_char,
@@ -810,7 +813,7 @@ pub unsafe extern "C" fn SCDetectSdpRegister() {
         url: String::from("/rules/sdp-keywords.html#sdp-attribute"),
         setup: sdp_attribute_setup,
     };
-    let _ = helper_keyword_register_sticky_buffer(&kw);
+    let _ = helper_keyword_register_multi_buffer(&kw);
     G_SDP_ATTRIBUTE_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
         b"sdp.attribute\0".as_ptr() as *const libc::c_char,
         b"sdp.attribute\0".as_ptr() as *const libc::c_char,
@@ -826,7 +829,7 @@ pub unsafe extern "C" fn SCDetectSdpRegister() {
         url: String::from("/rules/sdp-keywords.html#media-description-media"),
         setup: sdp_media_desc_media_setup,
     };
-    let _ = helper_keyword_register_sticky_buffer(&kw);
+    let _ = helper_keyword_register_multi_buffer(&kw);
     G_SDP_MEDIA_DESC_MEDIA_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
         b"sdp.media.media\0".as_ptr() as *const libc::c_char,
         b"sdp.media.media\0".as_ptr() as *const libc::c_char,
@@ -840,7 +843,7 @@ pub unsafe extern "C" fn SCDetectSdpRegister() {
         url: String::from("/rules/sdp-keywords.html#sdp-media-description-session-info"),
         setup: sdp_media_desc_session_info_setup,
     };
-    let _ = helper_keyword_register_sticky_buffer(&kw);
+    let _ = helper_keyword_register_multi_buffer(&kw);
     G_SDP_MEDIA_DESC_SESSION_INFO_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
         b"sdp.media.media_info\0".as_ptr() as *const libc::c_char,
         b"sdp.media.media_info\0".as_ptr() as *const libc::c_char,
@@ -854,7 +857,7 @@ pub unsafe extern "C" fn SCDetectSdpRegister() {
         url: String::from("/rules/sdp-keywords.html#sdp-media-description-connection-data"),
         setup: sdp_media_desc_connection_data_setup,
     };
-    let _ = helper_keyword_register_sticky_buffer(&kw);
+    let _ = helper_keyword_register_multi_buffer(&kw);
     G_SDP_MEDIA_DESC_CONNECTION_DATA_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
         b"sdp.media.connection_data\0".as_ptr() as *const libc::c_char,
         b"sdp.media.connection_data\0".as_ptr() as *const libc::c_char,
@@ -868,7 +871,7 @@ pub unsafe extern "C" fn SCDetectSdpRegister() {
         url: String::from("/rules/sdp-keywords.html#sdp-media-description-encryption-key"),
         setup: sdp_media_desc_encryption_key_setup,
     };
-    let _ = helper_keyword_register_sticky_buffer(&kw);
+    let _ = helper_keyword_register_multi_buffer(&kw);
     G_SDP_MEDIA_DESC_ENCRYPTION_KEY_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
         b"sdp.media.encryption_key\0".as_ptr() as *const libc::c_char,
         b"sdp.media.encryption_key\0".as_ptr() as *const libc::c_char,
diff --git a/rust/src/sip/detect.rs b/rust/src/sip/detect.rs
index c1ab833848..490d76fd16 100644
--- a/rust/src/sip/detect.rs
+++ b/rust/src/sip/detect.rs
@@ -18,7 +18,10 @@
 // written by Giuseppe Longo <giuseppe@glongo.it>
 
 use crate::core::{STREAM_TOCLIENT, STREAM_TOSERVER};
-use crate::detect::{helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer};
+use crate::detect::{
+    helper_keyword_register_multi_buffer, helper_keyword_register_sticky_buffer,
+    SigTableElmtStickyBuffer,
+};
 use crate::direction::Direction;
 use crate::sip::sip::{SIPTransaction, ALPROTO_SIP};
 use std::os::raw::{c_int, c_void};
@@ -493,7 +496,7 @@ pub unsafe extern "C" fn SCDetectSipRegister() {
         url: String::from("/rules/sip-keywords.html#sip-from"),
         setup: sip_from_hdr_setup,
     };
-    let _g_sip_from_hdr_kw_id = helper_keyword_register_sticky_buffer(&kw);
+    let _g_sip_from_hdr_kw_id = helper_keyword_register_multi_buffer(&kw);
     G_SIP_FROM_HDR_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
         b"sip.from\0".as_ptr() as *const libc::c_char,
         b"sip.from\0".as_ptr() as *const libc::c_char,
@@ -507,7 +510,7 @@ pub unsafe extern "C" fn SCDetectSipRegister() {
         url: String::from("/rules/sip-keywords.html#sip-to"),
         setup: sip_to_hdr_setup,
     };
-    let _g_sip_to_hdr_kw_id = helper_keyword_register_sticky_buffer(&kw);
+    let _g_sip_to_hdr_kw_id = helper_keyword_register_multi_buffer(&kw);
     G_SIP_TO_HDR_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
         b"sip.to\0".as_ptr() as *const libc::c_char,
         b"sip.to\0".as_ptr() as *const libc::c_char,
@@ -521,7 +524,7 @@ pub unsafe extern "C" fn SCDetectSipRegister() {
         url: String::from("/rules/sip-keywords.html#sip-via"),
         setup: sip_via_hdr_setup,
     };
-    let _g_sip_via_hdr_kw_id = helper_keyword_register_sticky_buffer(&kw);
+    let _g_sip_via_hdr_kw_id = helper_keyword_register_multi_buffer(&kw);
     G_SIP_VIA_HDR_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
         b"sip.via\0".as_ptr() as *const libc::c_char,
         b"sip.via\0".as_ptr() as *const libc::c_char,
@@ -535,7 +538,7 @@ pub unsafe extern "C" fn SCDetectSipRegister() {
         url: String::from("/rules/sip-keywords.html#sip-user-agent"),
         setup: sip_ua_hdr_setup,
     };
-    let _g_sip_ua_hdr_kw_id = helper_keyword_register_sticky_buffer(&kw);
+    let _g_sip_ua_hdr_kw_id = helper_keyword_register_multi_buffer(&kw);
     G_SIP_UA_HDR_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
         b"sip.ua\0".as_ptr() as *const libc::c_char,
         b"sip.ua\0".as_ptr() as *const libc::c_char,
@@ -549,7 +552,7 @@ pub unsafe extern "C" fn SCDetectSipRegister() {
         url: String::from("/rules/sip-keywords.html#sip-content-type"),
         setup: sip_content_type_hdr_setup,
     };
-    let _g_sip_content_type_hdr_kw_id = helper_keyword_register_sticky_buffer(&kw);
+    let _g_sip_content_type_hdr_kw_id = helper_keyword_register_multi_buffer(&kw);
     G_SIP_CONTENT_TYPE_HDR_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
         b"sip.content_type\0".as_ptr() as *const libc::c_char,
         b"sip.content_type\0".as_ptr() as *const libc::c_char,
@@ -563,7 +566,7 @@ pub unsafe extern "C" fn SCDetectSipRegister() {
         url: String::from("/rules/sip-keywords.html#sip-content-length"),
         setup: sip_content_length_hdr_setup,
     };
-    let _g_sip_content_length_hdr_kw_id = helper_keyword_register_sticky_buffer(&kw);
+    let _g_sip_content_length_hdr_kw_id = helper_keyword_register_multi_buffer(&kw);
     G_SIP_CONTENT_LENGTH_HDR_BUFFER_ID = SCDetectHelperMultiBufferMpmRegister(
         b"sip.content_length\0".as_ptr() as *const libc::c_char,
         b"sip.content_length\0".as_ptr() as *const libc::c_char,
diff --git a/src/detect-dns-name.c b/src/detect-dns-name.c
index 82f72881ea..ac70b38649 100644
--- a/src/detect-dns-name.c
+++ b/src/detect-dns-name.c
@@ -113,7 +113,7 @@ static int Register(const char *keyword, const char *desc, const char *doc,
     sigmatch_table[keyword_id].url = doc;
     sigmatch_table[keyword_id].Setup = Setup;
     sigmatch_table[keyword_id].flags |= SIGMATCH_NOOPT;
-    sigmatch_table[keyword_id].flags |= SIGMATCH_INFO_STICKY_BUFFER;
+    sigmatch_table[keyword_id].flags |= SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER;
 
     DetectAppLayerMultiRegister(keyword, alproto, SIG_FLAG_TOSERVER, 1, GetBufferFn, 2);
     DetectAppLayerMultiRegister(keyword, alproto, SIG_FLAG_TOCLIENT, 1, GetBufferFn, 2);
diff --git a/src/detect-email.c b/src/detect-email.c
index 4fd7e1db79..be5e9793f9 100644
--- a/src/detect-email.c
+++ b/src/detect-email.c
@@ -327,7 +327,7 @@ void DetectEmailRegister(void)
     kw.desc = "'Url' extracted from an email";
     kw.url = "/rules/email-keywords.html#email.url";
     kw.Setup = DetectMimeEmailUrlSetup;
-    kw.flags = SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;
+    kw.flags = SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER;
     SCDetectHelperKeywordRegister(&kw);
     g_mime_email_url_buffer_id = SCDetectHelperMultiBufferMpmRegister(
             "email.url", "MIME EMAIL URL", ALPROTO_SMTP, STREAM_TOSERVER, GetMimeEmailUrlData);
@@ -336,7 +336,7 @@ void DetectEmailRegister(void)
     kw.desc = "'Received' field from an email";
     kw.url = "/rules/email-keywords.html#email.received";
     kw.Setup = DetectMimeEmailReceivedSetup;
-    kw.flags = SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;
+    kw.flags = SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER;
     SCDetectHelperKeywordRegister(&kw);
     g_mime_email_received_buffer_id = SCDetectHelperMultiBufferMpmRegister("email.received",
             "MIME EMAIL RECEIVED", ALPROTO_SMTP, STREAM_TOSERVER, GetMimeEmailReceivedData);
diff --git a/src/detect-engine-register.c b/src/detect-engine-register.c
index 81da9fa1ee..c15cbebb59 100644
--- a/src/detect-engine-register.c
+++ b/src/detect-engine-register.c
@@ -329,6 +329,12 @@ static void PrintFeatureList(const SigTableElmt *e, char sep)
         printf("supports firewall");
         prev = 1;
     }
+    if (flags & SIGMATCH_INFO_MULTI_BUFFER) {
+        if (prev == 1)
+            printf("%c", sep);
+        printf("multi buffer");
+        prev = 1;
+    }
     if (e->Transform) {
         if (prev == 1)
             printf("%c", sep);
diff --git a/src/detect-file-data.c b/src/detect-file-data.c
index f21b9ff6c6..a8cd7bc65f 100644
--- a/src/detect-file-data.c
+++ b/src/detect-file-data.c
@@ -155,7 +155,8 @@ void DetectFiledataRegister(void)
 #ifdef UNITTESTS
     sigmatch_table[DETECT_FILE_DATA].RegisterTests = DetectFiledataRegisterTests;
 #endif
-    sigmatch_table[DETECT_FILE_DATA].flags = SIGMATCH_OPTIONAL_OPT | SIGMATCH_SUPPORT_DIR;
+    sigmatch_table[DETECT_FILE_DATA].flags =
+            SIGMATCH_OPTIONAL_OPT | SIGMATCH_SUPPORT_DIR | SIGMATCH_INFO_MULTI_BUFFER;
 
     filehandler_table[DETECT_FILE_DATA].name = "file_data";
     filehandler_table[DETECT_FILE_DATA].priority = 2;
diff --git a/src/detect-filemagic.c b/src/detect-filemagic.c
index 1d756bb4d7..0859b8bb78 100644
--- a/src/detect-filemagic.c
+++ b/src/detect-filemagic.c
@@ -114,8 +114,8 @@ void DetectFilemagicRegister(void)
     sigmatch_table[DETECT_FILE_MAGIC].desc = "sticky buffer to match on the file magic";
     sigmatch_table[DETECT_FILE_MAGIC].url = "/rules/file-keywords.html#filemagic";
     sigmatch_table[DETECT_FILE_MAGIC].Setup = DetectFilemagicSetupSticky;
-    sigmatch_table[DETECT_FILE_MAGIC].flags =
-            SIGMATCH_OPTIONAL_OPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_SUPPORT_DIR;
+    sigmatch_table[DETECT_FILE_MAGIC].flags = SIGMATCH_OPTIONAL_OPT | SIGMATCH_INFO_STICKY_BUFFER |
+                                              SIGMATCH_SUPPORT_DIR | SIGMATCH_INFO_MULTI_BUFFER;
 
     filehandler_table[DETECT_FILE_MAGIC].name = "file.magic",
     filehandler_table[DETECT_FILE_MAGIC].priority = 2;
diff --git a/src/detect-filename.c b/src/detect-filename.c
index df67166c32..b2a3cc3584 100644
--- a/src/detect-filename.c
+++ b/src/detect-filename.c
@@ -100,8 +100,8 @@ void DetectFilenameRegister(void)
     sigmatch_table[DETECT_FILE_NAME].desc = "sticky buffer to match on the file name";
     sigmatch_table[DETECT_FILE_NAME].url = "/rules/file-keywords.html#filename";
     sigmatch_table[DETECT_FILE_NAME].Setup = DetectFilenameSetupSticky;
-    sigmatch_table[DETECT_FILE_NAME].flags =
-            SIGMATCH_OPTIONAL_OPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_SUPPORT_DIR;
+    sigmatch_table[DETECT_FILE_NAME].flags = SIGMATCH_OPTIONAL_OPT | SIGMATCH_INFO_STICKY_BUFFER |
+                                             SIGMATCH_SUPPORT_DIR | SIGMATCH_INFO_MULTI_BUFFER;
 
     DetectBufferTypeSetDescriptionByName("file.name", "file name");
 
diff --git a/src/detect-ftp-completion-code.c b/src/detect-ftp-completion-code.c
index fe7eeb9636..474d96f89c 100644
--- a/src/detect-ftp-completion-code.c
+++ b/src/detect-ftp-completion-code.c
@@ -92,7 +92,8 @@ void DetectFtpCompletionCodeRegister(void)
             "sticky buffer to match on the FTP completion code buffer";
     sigmatch_table[DETECT_FTP_COMPLETION_CODE].url = "/rules/" KEYWORD_DOC;
     sigmatch_table[DETECT_FTP_COMPLETION_CODE].Setup = DetectFtpCompletionCodeSetup;
-    sigmatch_table[DETECT_FTP_COMPLETION_CODE].flags |= SIGMATCH_NOOPT;
+    sigmatch_table[DETECT_FTP_COMPLETION_CODE].flags =
+            SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER;
 
     DetectAppLayerMultiRegister(
             BUFFER_NAME, ALPROTO_FTP, SIG_FLAG_TOCLIENT, 0, DetectFTPCompletionCodeGetData, 2);
diff --git a/src/detect-ftp-reply.c b/src/detect-ftp-reply.c
index 52b3497d27..97dc5c3b35 100644
--- a/src/detect-ftp-reply.c
+++ b/src/detect-ftp-reply.c
@@ -94,7 +94,8 @@ void DetectFtpReplyRegister(void)
     sigmatch_table[DETECT_FTP_REPLY].desc = "sticky buffer to match on the FTP reply buffer";
     sigmatch_table[DETECT_FTP_REPLY].url = "/rules/" KEYWORD_DOC;
     sigmatch_table[DETECT_FTP_REPLY].Setup = DetectFtpReplySetup;
-    sigmatch_table[DETECT_FTP_REPLY].flags |= SIGMATCH_NOOPT;
+    sigmatch_table[DETECT_FTP_REPLY].flags |=
+            SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER;
 
     DetectAppLayerMultiRegister(
             BUFFER_NAME, ALPROTO_FTP, SIG_FLAG_TOCLIENT, 1, DetectFTPReplyGetData, 2);
diff --git a/src/detect-http-header.c b/src/detect-http-header.c
index e3e2d00308..42f89f7d18 100644
--- a/src/detect-http-header.c
+++ b/src/detect-http-header.c
@@ -589,7 +589,7 @@ void DetectHttpRequestHeaderRegister(void)
     sigmatch_table[DETECT_HTTP_REQUEST_HEADER].url = "/rules/http-keywords.html#request_header";
     sigmatch_table[DETECT_HTTP_REQUEST_HEADER].Setup = DetectHTTPRequestHeaderSetup;
     sigmatch_table[DETECT_HTTP_REQUEST_HEADER].flags |=
-            SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;
+            SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER;
 
     DetectAppLayerMultiRegister("http_request_header", ALPROTO_HTTP2, SIG_FLAG_TOSERVER,
             HTTP2StateOpen, SCHttp2TxGetHeader, 2);
@@ -622,7 +622,7 @@ void DetectHttpResponseHeaderRegister(void)
     sigmatch_table[DETECT_HTTP_RESPONSE_HEADER].url = "/rules/http2-keywords.html#response_header";
     sigmatch_table[DETECT_HTTP_RESPONSE_HEADER].Setup = DetectHTTPResponseHeaderSetup;
     sigmatch_table[DETECT_HTTP_RESPONSE_HEADER].flags |=
-            SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;
+            SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER;
 
     DetectAppLayerMultiRegister("http_response_header", ALPROTO_HTTP2, SIG_FLAG_TOCLIENT,
             HTTP2StateOpen, SCHttp2TxGetHeader, 2);
diff --git a/src/detect-http2.c b/src/detect-http2.c
index cde2e8eee2..5182df1a7b 100644
--- a/src/detect-http2.c
+++ b/src/detect-http2.c
@@ -173,7 +173,8 @@ void DetectHttp2Register(void)
     sigmatch_table[DETECT_HTTP2_HEADERNAME].desc = "sticky buffer to match on one HTTP2 header name";
     sigmatch_table[DETECT_HTTP2_HEADERNAME].url = "/rules/http2-keywords.html#header_name";
     sigmatch_table[DETECT_HTTP2_HEADERNAME].Setup = DetectHTTP2headerNameSetup;
-    sigmatch_table[DETECT_HTTP2_HEADERNAME].flags |= SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;
+    sigmatch_table[DETECT_HTTP2_HEADERNAME].flags |=
+            SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER;
 
     DetectAppLayerMultiRegister("http2_header_name", ALPROTO_HTTP2, SIG_FLAG_TOCLIENT,
             HTTP2StateOpen, SCHttp2TxGetHeaderName, 2);
diff --git a/src/detect-ike-vendor.c b/src/detect-ike-vendor.c
index 694ddfb954..d2c013ddd5 100644
--- a/src/detect-ike-vendor.c
+++ b/src/detect-ike-vendor.c
@@ -50,7 +50,8 @@ void DetectIkeVendorRegister(void)
     sigmatch_table[DETECT_IKE_VENDOR].url = "/rules/ike-keywords.html#ike-vendor";
     sigmatch_table[DETECT_IKE_VENDOR].Setup = DetectIkeVendorSetup;
     sigmatch_table[DETECT_IKE_VENDOR].flags |= SIGMATCH_NOOPT;
-    sigmatch_table[DETECT_IKE_VENDOR].flags |= SIGMATCH_INFO_STICKY_BUFFER;
+    sigmatch_table[DETECT_IKE_VENDOR].flags |=
+            SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER;
 
     DetectAppLayerMultiRegister(
             "ike.vendor", ALPROTO_IKE, SIG_FLAG_TOSERVER, 1, SCIkeTxGetVendor, 1);
diff --git a/src/detect-krb5-cname.c b/src/detect-krb5-cname.c
index e4ecfc6366..d4279a0ce9 100644
--- a/src/detect-krb5-cname.c
+++ b/src/detect-krb5-cname.c
@@ -56,7 +56,8 @@ void DetectKrb5CNameRegister(void)
     sigmatch_table[DETECT_KRB5_CNAME].alias = "krb5_cname";
     sigmatch_table[DETECT_KRB5_CNAME].url = "/rules/kerberos-keywords.html#krb5-cname";
     sigmatch_table[DETECT_KRB5_CNAME].Setup = DetectKrb5CNameSetup;
-    sigmatch_table[DETECT_KRB5_CNAME].flags |= SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;
+    sigmatch_table[DETECT_KRB5_CNAME].flags =
+            SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER;
     sigmatch_table[DETECT_KRB5_CNAME].desc = "sticky buffer to match on Kerberos 5 client name";
 
     DetectAppLayerMultiRegister(
diff --git a/src/detect-krb5-sname.c b/src/detect-krb5-sname.c
index 1be7d9615a..3cbe6185bb 100644
--- a/src/detect-krb5-sname.c
+++ b/src/detect-krb5-sname.c
@@ -56,7 +56,8 @@ void DetectKrb5SNameRegister(void)
     sigmatch_table[DETECT_KRB5_SNAME].alias = "krb5_sname";
     sigmatch_table[DETECT_KRB5_SNAME].url = "/rules/kerberos-keywords.html#krb5-sname";
     sigmatch_table[DETECT_KRB5_SNAME].Setup = DetectKrb5SNameSetup;
-    sigmatch_table[DETECT_KRB5_SNAME].flags |= SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;
+    sigmatch_table[DETECT_KRB5_SNAME].flags =
+            SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER;
     sigmatch_table[DETECT_KRB5_SNAME].desc = "sticky buffer to match on Kerberos 5 server name";
 
     DetectAppLayerMultiRegister(
diff --git a/src/detect-quic-cyu-hash.c b/src/detect-quic-cyu-hash.c
index fcff77d3b7..c42a325b95 100644
--- a/src/detect-quic-cyu-hash.c
+++ b/src/detect-quic-cyu-hash.c
@@ -63,7 +63,8 @@ void DetectQuicCyuHashRegister(void)
     sigmatch_table[DETECT_QUIC_CYU_HASH].desc = "sticky buffer to match on the QUIC CYU hash";
     sigmatch_table[DETECT_QUIC_CYU_HASH].url = "/rules/" KEYWORD_DOC;
     sigmatch_table[DETECT_QUIC_CYU_HASH].Setup = DetectQuicCyuHashSetup;
-    sigmatch_table[DETECT_QUIC_CYU_HASH].flags |= SIGMATCH_NOOPT;
+    sigmatch_table[DETECT_QUIC_CYU_HASH].flags =
+            SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER;
 #ifdef UNITTESTS
     sigmatch_table[DETECT_QUIC_CYU_HASH].RegisterTests = DetectQuicCyuHashRegisterTests;
 #endif
diff --git a/src/detect-quic-cyu-string.c b/src/detect-quic-cyu-string.c
index 5a36457f04..f99798ad06 100644
--- a/src/detect-quic-cyu-string.c
+++ b/src/detect-quic-cyu-string.c
@@ -61,7 +61,8 @@ void DetectQuicCyuStringRegister(void)
     sigmatch_table[DETECT_QUIC_CYU_STRING].desc = "sticky buffer to match on the QUIC CYU string";
     sigmatch_table[DETECT_QUIC_CYU_STRING].url = "/rules/" KEYWORD_DOC;
     sigmatch_table[DETECT_QUIC_CYU_STRING].Setup = DetectQuicCyuStringSetup;
-    sigmatch_table[DETECT_QUIC_CYU_STRING].flags |= SIGMATCH_NOOPT;
+    sigmatch_table[DETECT_QUIC_CYU_STRING].flags =
+            SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER;
 #ifdef UNITTESTS
     sigmatch_table[DETECT_QUIC_CYU_STRING].RegisterTests = DetectQuicCyuStringRegisterTests;
 #endif
diff --git a/src/detect-smtp.c b/src/detect-smtp.c
index 68f24e3d43..f958469a3c 100644
--- a/src/detect-smtp.c
+++ b/src/detect-smtp.c
@@ -155,7 +155,7 @@ void SCDetectSMTPRegister(void)
     kw.desc = "SMTP rcpt to buffer";
     kw.url = "/rules/smtp-keywords.html#smtp-rcpt-to";
     kw.Setup = DetectSmtpRcptToSetup;
-    kw.flags = SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;
+    kw.flags = SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER;
     SCDetectHelperKeywordRegister(&kw);
     g_smtp_rcpt_to_buffer_id = SCDetectHelperMultiBufferMpmRegister(
             "smtp.rcpt_to", "SMTP RCPT TO", ALPROTO_SMTP, STREAM_TOSERVER, GetSmtpRcptToData);
diff --git a/src/detect-tls-alpn.c b/src/detect-tls-alpn.c
index fc78288ee6..0311ea102e 100644
--- a/src/detect-tls-alpn.c
+++ b/src/detect-tls-alpn.c
@@ -89,7 +89,8 @@ void DetectTlsAlpnRegister(void)
     sigmatch_table[DETECT_TLS_ALPN].url = "/rules/tls-keywords.html#tls-alpn";
     sigmatch_table[DETECT_TLS_ALPN].Setup = DetectTlsAlpnSetup;
     sigmatch_table[DETECT_TLS_ALPN].flags |= SIGMATCH_NOOPT;
-    sigmatch_table[DETECT_TLS_ALPN].flags |= SIGMATCH_INFO_STICKY_BUFFER;
+    sigmatch_table[DETECT_TLS_ALPN].flags |=
+            SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER;
 
     DetectAppLayerMultiRegister("tls.alpn", ALPROTO_TLS, SIG_FLAG_TOSERVER,
             TLS_STATE_CLIENT_HELLO_DONE, TlsAlpnGetData, 2);
diff --git a/src/detect-tls-certs.c b/src/detect-tls-certs.c
index 8e71a985b0..36c986e65f 100644
--- a/src/detect-tls-certs.c
+++ b/src/detect-tls-certs.c
@@ -111,7 +111,8 @@ void DetectTlsCertsRegister(void)
     sigmatch_table[DETECT_TLS_CERTS].RegisterTests = DetectTlsCertsRegisterTests;
 #endif
     sigmatch_table[DETECT_TLS_CERTS].flags |= SIGMATCH_NOOPT;
-    sigmatch_table[DETECT_TLS_CERTS].flags |= SIGMATCH_INFO_STICKY_BUFFER;
+    sigmatch_table[DETECT_TLS_CERTS].flags |=
+            SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER;
 
     DetectAppLayerMultiRegister("tls.certs", ALPROTO_TLS, SIG_FLAG_TOCLIENT,
             TLS_STATE_SERVER_CERT_DONE, TlsCertsGetData, 2);
diff --git a/src/detect-tls-subjectaltname.c b/src/detect-tls-subjectaltname.c
index ee3800e481..49b69c76ba 100644
--- a/src/detect-tls-subjectaltname.c
+++ b/src/detect-tls-subjectaltname.c
@@ -88,7 +88,8 @@ void DetectTlsSubjectAltNameRegister(void)
     sigmatch_table[DETECT_TLS_SUBJECTALTNAME].url = "/rules/tls-keywords.html#tls-subjectaltname";
     sigmatch_table[DETECT_TLS_SUBJECTALTNAME].Setup = DetectTlsSubjectAltNameSetup;
     sigmatch_table[DETECT_TLS_SUBJECTALTNAME].flags |= SIGMATCH_NOOPT;
-    sigmatch_table[DETECT_TLS_SUBJECTALTNAME].flags |= SIGMATCH_INFO_STICKY_BUFFER;
+    sigmatch_table[DETECT_TLS_SUBJECTALTNAME].flags |=
+            SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER;
 
     DetectAppLayerMultiRegister("tls.subjectaltname", ALPROTO_TLS, SIG_FLAG_TOCLIENT,
             TLS_STATE_SERVER_CERT_DONE, TlsSubjectAltNameGetData, 2);
diff --git a/src/detect.h b/src/detect.h
index 6f092b5333..8b3622640c 100644
--- a/src/detect.h
+++ b/src/detect.h
@@ -1680,6 +1680,8 @@ typedef struct SigGroupHead_ {
 #define SIGMATCH_SUPPORT_FIREWALL BIT_U16(12)
 /** keyword supporting setting an optional direction */
 #define SIGMATCH_SUPPORT_DIR BIT_U16(13)
+/** keyword is a multi buffer */
+#define SIGMATCH_INFO_MULTI_BUFFER BIT_U16(14)
 
 enum DetectEngineTenantSelectors
 {