Hello. Everybody knows what a server does (listening for incoming new connection’s first packets) and what a client does (sending these first packets to the former) but I would like to know the real meaning of these keywords (that is: to_server/from_client and to_client/from_server) in a more technical way than is explained in doc. How does Suricata recognize which extreme is the client and which is the server? Because of the presence and direction of syn/syn-ack/ack packets? But, then, in a UDP connection, how does it do that? …because the first packet of a flow is considered always as a “client” request??? I think these concepts (“server” and “client”) are a bit abstract for understanding what is being really traced by Suricata. Thanks!