From 091290dd1c0e6b35f4295bebe0b29fe2ffb5fd1a Mon Sep 17 00:00:00 2001 From: Eric Leblond Date: Sun, 14 May 2017 20:40:51 +0200 Subject: [PATCH] app-layer: increment flow counter if one sided In the case of protocol like SMTP, we detect application layer on only one side. Consequence was a missed increment in the flow counter. --- src/app-layer.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/app-layer.c b/src/app-layer.c index 98a12ed94c..aa6dd6acf8 100644 --- a/src/app-layer.c +++ b/src/app-layer.c @@ -498,6 +498,7 @@ static int TCPProtoDetect(ThreadVars *tv, TcpSessionSetReassemblyDepth(ssn, AppLayerParserGetStreamDepth(f)); *alproto = ALPROTO_FAILED; + AppLayerIncFlowCounter(tv, f); FlagPacketFlow(p, f, flags); SCLogDebug("packet %u: pd done(us %u them %u), parser called (r==%d), APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION set",