Question regarding bidirectional flows in eve.json


Regarding the logging of bidirectional flows in eve.json (event_type:flow) each log contains the source and destination ip address as well as byte_toclient and bytes_toserver. How can i know who is the server and the client? Is the source ip the client and the destination ip is the server?

Thanks in advance.

Yes, the source IP is the client and the destination IP is the server.

I guess there could be cases where this isn’t always true, such as a packet picked up mid-stream where Suricata doesn’t know who initiated the flow.