tcp.syn | Detect | 4962 tcp.synack | Detect | 4852 tcp.rst | Detect | 3234 Does this look like a high amount of resets? Leonard -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20150827/b3825031/attachment.html>