[Oisf-users] Tagged packets different from original packets

[Luis Escamilla]

Hi everyone.

I’m trying to assemble a pcap file from the tagged packets resulting from the firing of an alert, the problem is, the packets in the resulting pcap file differ from the original packets, specifically the identification field is sometimes incremented or decremented by one.

Does anyone know what this issue could mean?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20190413/0cd354a7/attachment.html>