Project

General

Profile

Actions
Copy link

Feature #4282

open
JW CT

Ensure that the flags used for the initial TCP packets are saved

Feature #4282: Ensure that the flags used for the initial TCP packets are saved

Added by Jeff Weeks over 5 years ago. Updated about 2 months ago.

Status:
Triaged
Priority:
Normal
Assignee:
Community Ticket
Target version:
-
Effort:
Difficulty:
Label:

Description

Suricata saves the TCP flags which it sees inside `struct TcpStream_::tcp_flags` but this contains a union of all flags seen.
It can be beneficial to know the flags used solely in the first packet seen (in each direction).

Actions
Copy link

Also available in: PDF Atom