Suricata

The documentation mestions the tcp-stream keyword, but there is no
section dedicated to explain it, probably making it less known and used than it could be.

Brief explanation:
In order to tell Suricata to inspect the TCP stream as a whole, taking into consideration that TCP session splicing can happen, instead of using the 'tcp' keyword ('alert tcp...'), which will inspect both the specific packet and the stream, one should use 'tcp-stream' ('alert tcp-stream...').