Related: The packet does not match any known flow or socket, but the packet is expected because there is an existing socket that predicates it (examples of this are data on port 20 when there is an existing FTP session on port 21, or UDP data for an existing SIP connection on TCP port 5060).