Suricata flow event Data flow direction exception

I have observed a portion of flow events where the source address is the opposite of the destination address. This makes it difficult to analyze the data and it is “dirty” data for me.

I compared the Moloch events and Moloch could recognize that the direction of the data flow was normal.

I observed 2 RST packets among the packets identified by Suricata as being in the wrong direction, is this the reason?



Can you reproduce this with a pcap or is it related to the packet capture method Suricata is using?