# How to ignore FIN,ACK flag

**URL:** <https://forum.suricata.io/t/how-to-ignore-fin-ack-flag/2049>\
**Category:** Rules\
**Tags:** rules\
**Created:** [December 23, 2021, 7:23am UTC](https://forum.suricata.io/t/how-to-ignore-fin-ack-flag/2049 "2021-12-23T07:23:30Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![thinhle](https://avatars.discourse-cdn.com/v4/letter/t/ee59a6/32.png) [@thinhle](https://forum.suricata.io/u/thinhle)\
**Post date:** [December 23, 2021, 7:23am UTC](https://forum.suricata.io/t/how-to-ignore-fin-ack-flag/2049/1 "2021-12-23T07:23:30Z")

</div>

Hello all,

We want to add a connection into exception rules. We did it but sometime the alerts still pop up. It is very annoying. Let me explain something. The connection looks like as follow:  
step 1:A —(TCP handshake)–\> B  
step 2 :A—\> (TLSv1,2 handshake)–B  
After having completely TLSv1.2, sometime the issue happens :  
B ------ (FIN,ACK) ----- A. (i am sure about that A had never been sent any flag relating to “FINISH”). This Flag make suricata raise an alert “SURICATA Applayer wrong direction first data”.

How can we ignore this kind of TCP flag? Or anyone have another solution?

Thanks

---

<div class="post-metadata">

**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\
**Post date:** [December 27, 2021, 8:34pm UTC](https://forum.suricata.io/t/how-to-ignore-fin-ack-flag/2049/2 "2021-12-27T20:34:37Z")

</div>

How did you setup Suricata?  
Keep in mind those applayer alerts are quite noisy in production environments. Maybe just disable or suppress it unless you want to ensure to have just clean traffic.