Suricata missing some SMTP traffic

[pevma (Peter Manev)]

How do you do the replay test - tcpreplay, then stop suricata, then inventory the logs?