Inaccurate flow information about a conversation

Hi there,

Thank you in advance!

I used a simple PCAP file to test & inspect the flow event from the log eve.json.
But i noticed there were asymmetry information comparing w/ the same conversation by wireshark.
The output flow-info is as follows and i’m pretty sure that there’s no other flow events related with the same IP pair.


And the same conversation by Wireshark is as follows, please notice that the packets counts for both directions are greater then the ones from the above piece of log.

Can you share the pcap?

0000005327.pcap (4.0 KB)
Thanks, i’ve uploaded the pcap file.
Besides this pcap file, i found there’re other pcaps meet the same situation when replaying the packets via TcpReplay.

Figured it was becoz something wrong w/ the Tcpreplay tool that i used. sorry.

But i found Suricata would like to drop packets marked with issue ‘IPv4 total length exceeds packet length’ displayed in wireshark.