Suricata

A mismatch between the state of a connection as Suricata sees it and how the hosts see it can lead to cases where Suricata already times a connection out, while the connection isn't yet ready. In IPS mode Suricata can drop the rest of the connection. If midstream is enabled, the final part of the connection may be picked up again.