Hello,
What keyword allow match rules only packet mode, not established session.
I use --engine-analysis for check my rules. I get output “Rule matches on packets” When I’m used keyword “dsize”.
I also sometimes get for other rules “Rule matches on packets. Rule matches on reassembled stream.”
What priority will the modes have in this case?