Suricata

Suricata's TCP rejects over IPv6 appear to have an incorrect length field value, which can cause these packets to be dropped as invalid elsewhere in the network before reaching their destination. We believe the problem is at [1] - it looks like Suricata is populating that field with the packet total length (which is correct for IPv4) instead of the payload length (correct for IPv6). We have tested a patched version of Suricata with this line corrected (lpacket.len = LIBNET_TCP_H;) which solves the problem for us.

[1] https://github.com/OISF/suricata/blob/f8ec993401aaeb25f96b6f752ea8095bf5213af6/src/respond-reject-libnet11.c#L440