diff --git a/src/analyzer/Analyzer.h b/src/analyzer/Analyzer.h index f5387a2f4a..63b90aa3cd 100644 --- a/src/analyzer/Analyzer.h +++ b/src/analyzer/Analyzer.h @@ -860,6 +860,12 @@ public: */ void ForwardUndelivered(uint64_t seq, int len, bool orig) override; + /** + * Signals that Zeek has flipped the direction of the connection, meaning + * that originator and responder state need to be swapped. + */ + void FlipRoles() override { orig = ! orig; } + protected: friend class Analyzer; diff --git a/src/packet_analysis/protocol/tcp/TCPSessionAdapter.cc b/src/packet_analysis/protocol/tcp/TCPSessionAdapter.cc index 3bd418ea86..a85545a407 100644 --- a/src/packet_analysis/protocol/tcp/TCPSessionAdapter.cc +++ b/src/packet_analysis/protocol/tcp/TCPSessionAdapter.cc @@ -1162,6 +1162,9 @@ void TCPSessionAdapter::FlipRoles() orig = tmp_ep; orig->is_orig = ! orig->is_orig; resp->is_orig = ! resp->is_orig; + first_packet_seen = ((first_packet_seen & ORIG) ? RESP : 0) | + ((first_packet_seen & RESP) ? ORIG : 0); + is_partial = 0; // resetting, it may be re-established later } void TCPSessionAdapter::UpdateConnVal(RecordVal* conn_val)