On 06/27/2013 09:32 AM, Anoop Saldanha wrote:
> In src/app-layer-parser.c:
> 
>> @@ -1133,17 +1133,32 @@ void AppLayerTransactionUpdateInspectId(Flow *f, uint8_t flags)
>>      uint8_t direction = (flags & STREAM_TOSERVER) ? 0 : 1;
>>  
>>      FLOWLOCK_WRLOCK(f);
>> -    uint64_t total_txs = AppLayerGetTxCnt(f->alproto, f->alstate);
>> +
>> +    uint16_t alproto = f->alproto;
>> +    void *alstate = f->alstate;
>> +
>> +    if (alproto == ALPROTO_SMB) {
>> +        if (((SMBState *)alstate)->dcerpc_present) {
>> +            alproto = ALPROTO_DCERPC;
>> +            alstate = (((SMBState *)alstate)->dcerpc);
> 
> yeah. I was wondering if we should provide better support for this in
> Flow and destate.
> 
> Say an alproto[] array in Flow? We will have to run alproto inspection
> on each alproto in the array and store de_state separately from where I
> see it. Requires some changes though in how we store it in destate too.

Think I would prefer a retrieval func in the app layer api. Don't want
to grow flow even further.