@oscar-pulgarin I just switched over to showing raw longs, and did a find for last 3000 entries and only thing I see with unkn in it is this
Mar 7 07:57:48 sg4860 filterlog[56621]: 290,,,1512830048,igb2,match,pass,in,4,0x0,,64,0,0,DF,6,tcp,68,192.168.2.203,52.14.255.202,50722,443,0,S,886123752,,65535,,mss;nop;wscale;Unknown Option %u;nop;nop;TS;sackOK;eol
Which has to do with option, not in out direction