Some times I see packets coming to Suricata are out of order,
06:49:35.730200 IP 10.99.200.245.60680 > sfo03s24-in-f4.1e100.net.http: Flags [S], seq 3966659540, win 64240, options [mss 1328,sackOK,TS val 1065776903 ecr 0,nop,wscale 7], length 0
06:49:35.732423 IP sfo03s24-in-f4.1e100.net.http > 10.99.200.245.60680: Flags [S.], seq 3704884386, ack 3966659541, win 65535, options [mss 1412,sackOK,TS val 1041542098 ecr 1065776903,nop,wscale 8], length 0
06:49:35.732821 IP 10.99.200.245.60680 > sfo03s24-in-f4.1e100.net.http: Flags [P.], seq 1:76, ack 1, win 502, options [nop,nop,TS val 1065776906 ecr 1041542098], length 75: HTTP: GET / HTTP/1.1
06:49:35.732831 IP 10.99.200.245.60680 > sfo03s24-in-f4.1e100.net.http: Flags [.], ack 1, win 502, options [nop,nop,TS val 1065776906 ecr 1041542098], length 0
06:49:35.735929 IP sfo03s24-in-f4.1e100.net.http > 10.99.200.245.60680: Flags [.], ack 76, win 1050, options [nop,nop,TS val 1041542101 ecr 1065776906], length 0
The data packet comes before ACK here.
We are feeding out of order packets (ACK after data pkt) to Suricata. It refuses to inspect the data pkt as ACK is not yet read by it and returns it from the tap_out interface, our custom OS assumes it to be a GOOD TO GO pkt and processes further
We want Suricata to drop this packet till the ACK is read and TCP 3-way handshake is complete?
Any idea how can we achieve this? Is there a way to make a custom rule for this case?