Host source/destinations are sometimes backwards in the TCP conversations feature
Description including problem, use cases, benefits, and/or goals
In the TCP conversations view, Address A usually shows the source host and Address B usually shows the destination host. However, it looks like if the source port is lower than the ephemeral port used by the client, the TCP conversation view orders the hosts backwards. It would be nice if Wireshark would order the clients correctly based off the 3-way handshake.
I'm using this feature to build firewall rules, but having the hosts sometimes backwards adds manual work which could be significant with hundreds of thousands of conversations.
Links / references / protocol specifications
Original post I made which discovered this: https://ask.wireshark.org/question/19419/why-are-some-tcp-conversations-shown-backwardsreversed/