traffice oppsite

[qoo7972365]

Hello I'm facing prolblem the traffice is oppsite,and I check log in forwarded node log "/nsm/zeek/logs/current"

and fellow uid check other log I see conn.log also have wrong log,

My problem is traffice should
10.21.11.132:xxxxx(high port) >>> 10.74.64.4 7443 this is correct
but always happen
10.74.64.4:7443 >>>> 10.21.11.132:xxxxx(high port) I think this is oppsite traffice

[InfosecGoon]

You should be getting both of those logs, representing the two sides of the network flow (from the client to the server, and the response from the server back to the client).

[qoo7972365]

This is security onion traffic log

This is our fortinet traffic log

This is our EDR log ,for the source side log

Sorry I couldn't provide destination side log because it didn't record

[qoo7972365]

anyone can help me to resolve this?