Replies are usually the worst offenders usually, more tags means more identifiable, because there inst one standard canonical way to do tagging, snort always sorts tags in lexicographical order so its consistent, but we also add client tag by default