Pcap Capture - Include 3WHS and remaining flow data before TCP/HTTP alert

2

It’s not that easy, you can learn more details about the advantages but also limitations of the conditional pcap at the talk from Suricon 2021 SuriCon 2021 | Boston – SURICON from Eric Leblond.