On 08/30/2013 05:25 PM, Anoop Saldanha wrote:
> In src/flow.h:
> 
>> @@ -320,6 +320,10 @@
>>      uint8_t pad0;
>>  
>>      uint16_t alproto; /**< \brief application level protocol */
>> +    uint16_t alproto_ts;
>> +    uint16_t alproto_tc;
>> +
>> +    uint32_t data_al_so_far[2];
> 
> data_al_so_far is used in app-layer.c. The idea is if we haven't figured
> the protocol for one direction, but we know the proto for the other
> direction, we send the stream from the unknown direction for the other
> direction proto. But while we do this we can't set the
> PROTO_DETECTION_COMPLETED flag for the stream, which means stream
> reassembly continues sending the reassembled segments from the start of
> the stream. Hence we need to know how much of data we have already send
> to the app layer so far.

Ah, it seems github decided to not show me app-layer.c. Missed that part.