docs: def _cts_or_stc(data):
          """Does the data look like a Client to Server (cts) or Server to Client (stc) traffic?"""
  
          # UDP/TCP
          if data['transport']:
  
              # TCP flags
              if data['transport']['type'] == 'TCP':
                  flags = data['transport']['flags']
  
                  # Syn/Ack or fin/ack is a server response
                  if 'syn_ack' in flags or 'fin_ack' in flags:
                      return 'STC'
  
                  # Syn or fin is a client response
                  if 'syn' in flags or 'fin' in flags:
                      return 'CTS'
  
              # Source Port/Destination Port
              if 'sport' in data['transport']:
                  sport = data['transport']['sport']
                  dport = data['transport']['dport']
  
                  # High port talking to low port
                  if dport < 1024 and sport > dport:
                      return 'CTS'
  
                  # Low port talking to high port
                  if sport < 1024 and sport < dport:
                      return 'STC'
  
                  # Wow... guessing
                  return 'STC' if sport < dport else 'CTS'
  
          # Internal/External
          if 'src' in data['packet'] and 'dst' in data['packet']:
              src = net_utils.inet_to_str(data['packet']['src'])
              dst = net_utils.inet_to_str(data['packet']['dst'])
  
              # Internal talking to external?
              if net_utils.is_internal(src) and not net_utils.is_internal(dst):
                  return 'CTS'
  
              # External talking to internal?
              if net_utils.is_internal(dst) and not net_utils.is_internal(src):
                  return 'STC'
  
          # Okay we have no idea
          return 'CTS'