Suricata

This is likely an issue just with UDP traffic.

If a flow is dropped, we still see app-layer output associated with that flow.

There are still some unknowns/ aspects to confirm - could this happen with TCP? Is this just an output issue, or are we actually not totally dropping the flow?

Expected behavior:
If Suri drops an entire flow, we want the engine to:
- mark all associated transactions for that flow as completed
- log, in the respective drop event, the relevant info for the associated transaction
- stop detection and inspection work on that flow, once the drop(s) is processed.