<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
Packets in Suricata are defragmented, finally becoming stream. So it's impossible to relate the specific packet to tx.</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
And I wander why DetectRunTx() traverses through the tx list in f->alstate. Any suggestion is appreciated. Thanks in advance.</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
<br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
<span><span>packet -> flow -> alstate -> tx</span></span></div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
<span><span> n : 1 : 1 : m</span></span></div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
<span><span> </span></span></div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
<span><span><br>
</span></span></div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
<span><span>static void DetectRunTx(ThreadVars *tv,<br>
</span>
<div> DetectEngineCtx *de_ctx,</div>
<div> DetectEngineThreadCtx *det_ctx,</div>
<div> Packet *p,</div>
<div> Flow *f,</div>
<div> DetectRunScratchpad *scratch)</div>
<div>{</div>
<div> const uint8_t flow_flags = scratch->flow_flags;</div>
<div> const SigGroupHead * const sgh = scratch->sgh;</div>
<div> void * const alstate = f->alstate;</div>
<div> const uint8_t ipproto = f->proto;</div>
<div> const AppProto alproto = f->alproto;</div>
<div></div>
<div> const uint64_t total_txs = AppLayerParserGetTxCnt(f, alstate);</div>
<div> uint64_t tx_id_min = AppLayerParserGetTransactionInspectId(f->alparser, flow_flags);</div>
<div> const int tx_end_state = AppLayerParserGetStateProgressCompletionStatus(alproto, flow_flags);</div>
<div></div>
<div> AppLayerGetTxIteratorFunc IterFunc = AppLayerGetTxIterator(ipproto, alproto);</div>
<div> AppLayerGetTxIterState state;</div>
<div> memset(&state, 0, sizeof(state));</div>
<div></div>
<div><span style="color: rgb(200, 38, 19);"> while (1) {</span></div>
<div><span style="color: rgb(200, 38, 19);"> AppLayerGetTxIterTuple ires = IterFunc(ipproto, alproto, alstate, tx_id_min, total_txs, &state);</span></div>
<div><span style="color: rgb(200, 38, 19);"> if (ires.tx_ptr == NULL)</span></div>
<div><span style="color: rgb(200, 38, 19);"> break;</span></div>
<div></div>
<div> DetectTransaction tx = GetDetectTx(ipproto, alproto,</div>
<div> alstate, ires.tx_id, ires.tx_ptr, tx_end_state, flow_flags);</div>
<div> if (tx.tx_ptr == NULL) {</div>
<div> SCLogDebug("%p/%"PRIu64" no transaction to inspect",</div>
<span> tx.tx_ptr, tx_id_min);</span><br>
</span></div>
</body>
</html>