Question regarding bidirectional flows in eve.json

Help
1

Hello,

Regarding the logging of bidirectional flows in eve.json (event_type:flow) each log contains the source and destination ip address as well as byte_toclient and bytes_toserver. How can i know who is the server and the client? Is the source ip the client and the destination ip is the server?

Thanks in advance.

2

Yes, the source IP is the client and the destination IP is the server.

I guess there could be cases where this isn’t always true, such as a packet picked up mid-stream where Suricata doesn’t know who initiated the flow.