diff --git a/src/flow-hash.c b/src/flow-hash.c index fcd957c72e..bdcc0dc440 100644 --- a/src/flow-hash.c +++ b/src/flow-hash.c @@ -768,6 +768,7 @@ static Flow *TcpReuseReplace(ThreadVars *tv, FlowLookupStruct *fls, FlowBucket * old_f->timeout_at = 0; /* get some settings that we move over to the new flow */ FlowThreadId thread_id[2] = { old_f->thread_id[0], old_f->thread_id[1] }; + old_f->flow_end_flags |= FLOW_END_FLAG_TCPREUSE; /* flow is unlocked by caller */ diff --git a/src/flow.h b/src/flow.h index 554f9fca4a..dc3b09afd4 100644 --- a/src/flow.h +++ b/src/flow.h @@ -244,6 +244,7 @@ typedef struct AppLayerParserState_ AppLayerParserState; #define FLOW_END_FLAG_TIMEOUT 0x02 #define FLOW_END_FLAG_FORCED 0x04 #define FLOW_END_FLAG_SHUTDOWN 0x08 +#define FLOW_END_FLAG_TCPREUSE 0x10 /** Mutex or RWLocks for the flow. */ //#define FLOWLOCK_RWLOCK diff --git a/src/output-json-flow.c b/src/output-json-flow.c index 015c72f8c7..d30866636f 100644 --- a/src/output-json-flow.c +++ b/src/output-json-flow.c @@ -258,7 +258,9 @@ static void EveFlowLogJSON(OutputJsonThreadCtx *aft, JsonBuilder *jb, Flow *f) } const char *reason = NULL; - if (f->flow_end_flags & FLOW_END_FLAG_FORCED) + if (f->flow_end_flags & FLOW_END_FLAG_TCPREUSE) + reason = "tcp_reuse"; + else if (f->flow_end_flags & FLOW_END_FLAG_FORCED) reason = "forced"; else if (f->flow_end_flags & FLOW_END_FLAG_SHUTDOWN) reason = "shutdown";