Suricata

Like web socket, COTP...

Idea to do this : create a synthetic sub flow, so that each flow has its own app-layer

Philippe Antoine wrote in #note-4:

Idea to do this : create a synthetic sub flow, so that each flow has its own app-layer

People may get confused if two flows get logged (one synthetic and a real one) with different app-layers