Best methods to co-relate the client and server side flows
Team, based on a captured pcap where both client and server side conversations have been captured, could you recommend the best ways to correlate which client side TCP stream for example relates with the TCP stream client side. I am aware of the flow ID and peer ID usage when using F5Trailer and -nnn but have found on some occasions that the relation is incorrect (e.g. F5 sends RST to Client claiming RST on remote server but server side connection was properly closed), even F5 TAC has mentioned that -p also gives wrong result sometimes. So I am looking for definite ways without replying heavily on the F5 Eth trailers, at present I am filtering using one serverside stream and then going forward on the stream +1 and so on till I see some matching like RST occurring on both Client and Server end on wireshark eg. tcp.stream == 10 or tcp.stream == 12