Suricata

I had an issue on my switch until today where some packets entering the switch were getting tagged with Priority 2, and others were not (still Priority 0) even though every interface had a priority of 2 set. This was causing Suricata to split my streams when vlan: use-for-tracking was set to true.

While I think it's probably an abnormal practice to have different priorities on packets going different directions in a stream, I think it is counter-intuitive to break the flow on that. But if this is expected then please close this ticket.

I've attached a screenshot of the two packets in case that helps.