FIRST IP CONSIDERED AS ATTACKER

[Yumlembam]

Won't there be any problem if you consider the first IP as an attacker?. Pcap file can contain lots of non attacker IP

[lucadivit]

At now there are two policies not only "first IP is the attacker". But in some cases is a right policy. Think about a DOS attack (by one attacker). Who starts the comunication can be only the attacker. I know that is a very strong supposition but it's very difficult determinig who is the attacker and first IP was useful for my purporse in the past. If you have some other ideas you can share them here.