mirror of https://github.com/OISF/suricata
dcerpc: require PFC_LAST_FRAG for completion
DCERPC REQUEST/RESPONSE records can have their stub data fragmented across multiple PDUs. The flags that convey the state of the current PDU are as follows: PFC_FIRST_FRAG: first fragment of (fragmented) data PFC_LAST_FRAG: last fragment of (fragmented) data PFC_FIRST_FRAG && PFC_LAST_FRAG: no fragmentation Consider a REQUEST/RESPONSE complete only when the PFC_LAST_FRAG flag is found to be set. Ticket: 9240pull/16497/head
parent
912c545075
commit
4e875c80d7
Loading…
Reference in New Issue