For a midstream TCP, when the first seen payload is nop data, the alproto will never be detected although many more subsequence payload data match alproto patterns.
1.I have two physical machines, an IPC and a NVR for SIP traffic.
2.Alproto SIP can not be detected when mirred traffic is midstream.
sip_tcp-2.pcapng (1.7 KB)