On 06/27/2013 10:00 AM, Anoop Saldanha wrote:
> In src/app-layer-parser.c:
> 
>> @@ -1133,17 +1133,32 @@ void AppLayerTransactionUpdateInspectId(Flow *f, uint8_t flags)
>>      uint8_t direction = (flags & STREAM_TOSERVER) ? 0 : 1;
>>  
>>      FLOWLOCK_WRLOCK(f);
>> -    uint64_t total_txs = AppLayerGetTxCnt(f->alproto, f->alstate);
>> +
>> +    uint16_t alproto = f->alproto;
>> +    void *alstate = f->alstate;
>> +
>> +    if (alproto == ALPROTO_SMB) {
>> +        if (((SMBState *)alstate)->dcerpc_present) {
>> +            alproto = ALPROTO_DCERPC;
>> +            alstate = (((SMBState *)alstate)->dcerpc);
> 
> So code wise how would that work? How will it look when I replaced the
> above small piece of code?

Probably something like:

if (AlprotoSupportsNestedState(alproto)) {
    AppLayerGetNestedState(smb_state, &alproto, &alstate);
}