Those rules were evaluated as false positives on "closed" networks (limited number of users), all trusted. They mostly fired on wifi clients, hence the "wifi clients moving around" comment.
That "category" of rules (weird traffic) was generally either caused by a wifi client moving from point A to point B and missing a couple of packets OR more rarely by suricata itself, that is after suricata has cleared the states for a blocked host. Technically the firewall has no record of an active connection, which triggers the "weird traffic" category.
As I said, false positives. Disable.
Note: By category I'm talking about my categories. There are 3 categories: 1)Rules that should have their creators exiled from earth, subcategories idiotic rules (simple http request), stupidly outdated rules (firefox 3.x rules). 2)Weird traffic rules, includes "unknown" traffic, or theoretically impossible traffic (in theory, theory and practice are equal. Practically they are not) and finally 3) Rules that their creators should be honored with nobel prices and generally thought of as humanity's $deities.
