diff --git a/src/app-layer.c b/src/app-layer.c index 9cf276f235..bd1942e127 100644 --- a/src/app-layer.c +++ b/src/app-layer.c @@ -403,7 +403,9 @@ static int TCPProtoDetect(ThreadVars *tv, /* if protocol detection indicated that we need to reverse * the direction of the flow, do it now. We flip the flow, * packet and the direction flags */ - if (reverse_flow && (ssn->flags & STREAMTCP_FLAG_MIDSTREAM)) { + if (reverse_flow && + ((ssn->flags & (STREAMTCP_FLAG_MIDSTREAM | STREAMTCP_FLAG_MIDSTREAM_SYNACK)) == + STREAMTCP_FLAG_MIDSTREAM)) { /* but only if we didn't already detect it on the other side. */ if (*alproto_otherdir == ALPROTO_UNKNOWN) { SCLogDebug("reversing flow after proto detect told us so");