Suricata

When a "stream starter" packet finds an existing TCP flow, the flow will be evaluated for reuse.

The following scenario isn't handled well:

1. Suricata starts after a tool has just stopped using lots of connections (in my case, ab stress testing a webserver)
2. even though the client is closed already, the server is still doing connection cleanup sending many FINs and later RSTs
3. Suricata creates flows for these packets, but no TCP sessions
4. client resumes testing, creating flows that have the same 5 tuple as the flows created for the FIN/RST packets
5. Suricata refuses to "reuse" the flows as the condition "tcp flow w/o session" is not considered valid for session reuse
6. new TCP connection is not properly tracked and evaluated in parsing and detection