On 06/27/2013 09:33 AM, Anoop Saldanha wrote:
> In src/detect-engine-content-inspection.c:
> 
>> @@ -44,6 +44,7 @@
>>  #include "detect-luajit.h"
>>  
>>  #include "app-layer-dcerpc.h"
>> +#include "util-streaming-parser.h"
> 
> dce state holds a var indicating the endianness of the current buffer.
> The var holds the endian flag form util-streaming-parser.h

Think the app layer parser should translate it then.