I have pcaps from Cisco2960 span port and found some tcp handshake has weird order 3-way handshake.
It seems first packet order between sessions is not guaranted for cisco span. maybe.
Current state transition is
INIT -- syn --> SYN1 -- syn&ack --> SYN2 -- ack --> ESTABLISHED
New state transition starts with SYN1 or SYN2 and adds(revive actually)
STATE_ACK to handle both cases.
case1 : INIT -- syn --> SYN1 -- syn&ack -->ACK -- ack --> ESTABLISHED (normal)
case2 : INIT -- syn&ack --> SYN2 -- syn -->ACK -- ack --> ESTABLISHED
(weird)
If the snaplen is lower than the total frame length announced,
ssldump won't be able to reassemble the payload. "Length mismatch"
error. Tested on Ethernet uplinks supporting jumbo frame.