diff --git a/scripts/base/protocols/rfb/dpd.sig b/scripts/base/protocols/rfb/dpd.sig
index 40793ad590..c105070b24 100644
--- a/scripts/base/protocols/rfb/dpd.sig
+++ b/scripts/base/protocols/rfb/dpd.sig
@@ -1,6 +1,7 @@
 signature dpd_rfb_server {
 	ip-proto == tcp
 	payload /^RFB/
+	tcp-state responder
 	requires-reverse-signature dpd_rfb_client
 	enable "rfb"
 }
@@ -9,4 +10,4 @@ signature dpd_rfb_client {
 	ip-proto == tcp
 	payload /^RFB/
 	tcp-state originator
-}
\ No newline at end of file
+}