@cardigliano , From my tests there is no option to let FT to close flow on TCP flags RST.
If I want to close a flow and get the relevant callbacks to be called, what is the recommended way to let FT to close a flow when received RST TCP flags?
Can I call on_end_flow callback from on_packet callback when I see that I have RST flag? (e.g. I want to force end the flow on RST flag)
From inside on_end_callback I than call pfring_ft_flow_free
When I do that the next packet that I call from this PCAP file that has the same 5 tuple, I get again on_packet callback instead of getting on_new_flow callback. Why is that?
@cardigliano , From my tests there is no option to let FT to close flow on TCP flags RST.
If I want to close a flow and get the relevant callbacks to be called, what is the recommended way to let FT to close a flow when received RST TCP flags?
Can I call on_end_flow callback from on_packet callback when I see that I have RST flag? (e.g. I want to force end the flow on RST flag)
From inside on_end_callback I than call pfring_ft_flow_free
When I do that the next packet that I call from this PCAP file that has the same 5 tuple, I get again on_packet callback instead of getting on_new_flow callback. Why is that?