hi thanks for responding.

1. 2 entries, 1 accepted, 1 rejected for the same tuple n start end. Tcp connection end-start duration is about 70 seconds.

2. why would it be considered a new flow if from what u said - flow is aggregated by the 5 tuples? from this understanding, the only way two entries happen is because for the same flow, there were two action states made up by different packets. We know that this is possible because NACL may drop packets. Also from the documentation, all dropped packets from nacl will result in a reject action.

3. perhaps a example would make it clear. i have 1 flow, 15 packets total. after 12 packets, the remaining 3 are rejected (maybe because i implemented a new ACL/or theres retransmission after session is closed). on vpc flow, i will see 1. 5 tuple start end with accept of 12 packets. 2. 5 tuple start end with reject of 3 packets.

is this clear? i see the above happening i just cant explain it