Hello
We are using Netography for NetFlow and we cannot find packets with the sync flag during queries, such as:
ip == 10.40.32.67 AND ip == 10.67.51.215 and tcpflags.ack == true
Removing "tcpflags.ack == true" does shield results but all results have the "tcpflags.ack == false".
It seems since version 8.x, the TCP flags are not populated, according to this link:
https://community.cisco.com/t5/security-knowledge-base/netflow-on-asa/ta-p/3119176
It mentions "unlike the routing platforms we will not populate the ToS bits or the TCP flags".
This is true as packets from routers are found with the sync flag during queries.
Any idea if there is a way to capture packets with the sync flag for NetFlow using ASAs?
