From 9e5e78104d6c1ee30d71ae7f8066f3b6b68a7ea9 Mon Sep 17 00:00:00 2001
From: Pablo Rincon <pablo.rincon.crespo@gmail.com>
Date: Fri, 12 Mar 2010 19:22:01 +0100
Subject: [PATCH] Inline functions

---
 src/counters.c                   |  209 ----------------
 src/counters.h                   |  221 +++++++++++++++++-
 src/decode-icmpv4.c              |   52 ----
 src/decode-icmpv4.h              |   56 +++++-
 src/decode-icmpv6.c              |   71 ------
 src/decode-icmpv6.h              |   76 ++++++-
 src/decode-ipv4.c                |   56 +-----
 src/decode-ipv4.h                |   61 +++++-
 src/decode-tcp.c                 |  122 ----------
 src/decode-tcp.h                 |  129 ++++++++++-
 src/decode-udp.c                 |  120 ----------
 src/decode-udp.h                 |  127 ++++++++++-
 src/decode.c                     |   20 --
 src/decode.h                     |   28 ++-
 src/detect-classtype.c           |   80 +++----
 src/detect-classtype.h           |   31 +++
 src/detect-content.c             |   55 -----
 src/detect-content.h             |   59 +++++
 src/detect-dce-iface.c           |   94 +++-----
 src/detect-dce-iface.h           |   30 +++
 src/detect-dce-opnum.c           |   98 +++-----
 src/detect-dce-opnum.h           |   24 ++
 src/detect-engine-address.h      |    3 +-
 src/detect-engine-port.h         |    4 +
 src/detect-engine-sigorder.c     |  199 ----------------
 src/detect-engine-sigorder.h     |  224 ++++++++++++++++++
 src/detect-fast-pattern.c        |    5 -
 src/detect-fast-pattern.h        |    1 -
 src/detect-stream_size.c         |   44 ----
 src/detect-stream_size.h         |   47 ++++
 src/detect-uricontent.c          |  129 ----------
 src/detect-uricontent.h          |  132 +++++++++++
 src/detect.c                     |   54 -----
 src/detect.h                     |  100 +++++++--
 src/flow.c                       |   36 ---
 src/flow.h                       |   38 +++
 src/stream-tcp.c                 |   33 ---
 src/stream-tcp.h                 |   42 ++++
 src/suricata-common.h            |   31 +++
 src/suricata.h                   |    4 -
 src/tm-threads.c                 |  100 --------
 src/tm-threads.h                 |  113 +++++++++-
 src/util-byte.c                  |  335 --------------------------
 src/util-byte.h                  |  365 +++++++++++++++++++++++++++-
 src/util-classification-config.c |  203 +---------------
 src/util-classification-config.h |  197 +++++++++++++++
 src/util-debug-filters.c         |  289 +----------------------
 src/util-debug-filters.h         |  297 +++++++++++++++++++++++
 src/util-debug.c                 |  472 +------------------------------------
 src/util-debug.h                 |  485 +++++++++++++++++++++++++++++++++++++-
 src/util-mpm-b2g-cuda.c          |  326 -------------------------
 src/util-mpm-b2g-cuda.h          |  321 +++++++++++++++++++++++++
 src/util-mpm-b2g.c               |  305 ------------------------
 src/util-mpm-b2g.h               |  291 +++++++++++++++++++++++
 src/util-mpm-b3g.c               |  275 ---------------------
 src/util-mpm-b3g.h               |  285 ++++++++++++++++++++++
 src/util-mpm-wumanber.c          |  290 +----------------------
 src/util-mpm-wumanber.h          |  260 ++++++++++++++++++++
 src/util-mpm.c                   |  105 --------
 src/util-mpm.h                   |  111 +++++++++-
 src/util-radix-tree.c            |  106 +--------
 src/util-radix-tree.h            |  111 +++++++++
 src/util-spm-bm.c                |  234 ------------------
 src/util-spm-bm.h                |  254 +++++++++++++++++++-
 src/util-spm-bs.c                |   90 +-------
 src/util-spm-bs.h                |   96 ++++++++-
 src/util-spm-bs2bm.c             |  142 +-----------
 src/util-spm-bs2bm.h             |  151 ++++++++++++-
 src/util-spm.c                   |  108 +--------
 src/util-spm.h                   |   92 +++++++-
 70 files changed, 4961 insertions(+), 4793 deletions(-)

diff --git a/src/counters.c b/src/counters.c
index 5fb41f7..56e4df1 100644
--- a/src/counters.c
+++ b/src/counters.c
@@ -1278,215 +1278,6 @@ int SCPerfCounterDisplay(uint16_t id, SCPerfContext *pctx, int disp)
 }
 
 /**
- * \brief Increments the local counter
- *
- * \param id  Index of the counter in the counter array
- * \param pca Counter array that holds the local counters for this TM
- */
-inline void SCPerfCounterIncr(uint16_t id, SCPerfCounterArray *pca)
-{
-    if (pca == NULL) {
-        SCLogDebug("counterarray is NULL");
-        return;
-    }
-    if ((id < 1) || (id > pca->size)) {
-        SCLogDebug("counter doesn't exist");
-        return;
-    }
-
-    switch (pca->head[id].pc->value->type) {
-        case SC_PERF_TYPE_UINT64:
-            pca->head[id].ui64_cnt++;
-            break;
-        case SC_PERF_TYPE_DOUBLE:
-            pca->head[id].d_cnt++;
-            break;
-    }
-
-    if (pca->head[id].syncs == ULONG_MAX) {
-        pca->head[id].syncs = 0;
-        pca->head[id].wrapped_syncs++;
-    }
-    pca->head[id].syncs++;
-
-    return;
-}
-
-/**
- * \brief Adds a value of type uint64_t to the local counter.
- *
- * \param id  ID of the counter as set by the API
- * \param pca Counter array that holds the local counter for this TM
- * \param x   Value to add to this local counter
- */
-inline void SCPerfCounterAddUI64(uint16_t id, SCPerfCounterArray *pca, uint64_t x)
-{
-    if (!pca) {
-        SCLogDebug("counterarray is NULL");
-        return;
-    }
-    if ((id < 1) || (id > pca->size)) {
-        SCLogDebug("counter doesn't exist");
-        return;
-    }
-
-    switch (pca->head[id].pc->value->type) {
-        case SC_PERF_TYPE_UINT64:
-            pca->head[id].ui64_cnt += x;
-            break;
-        case SC_PERF_TYPE_DOUBLE:
-            pca->head[id].d_cnt += x;
-            break;
-    }
-
-    if (pca->head[id].syncs == ULONG_MAX) {
-        pca->head[id].syncs = 0;
-        pca->head[id].wrapped_syncs++;
-    }
-    pca->head[id].syncs++;
-
-    return;
-}
-
-/**
- * \brief Adds a value of type double to the local counter
- *
- * \param id  ID of the counter as set by the API
- * \param pca Counter array that holds the local counter for this TM
- * \param x   Value to add to this local counter
- */
-inline void SCPerfCounterAddDouble(uint16_t id, SCPerfCounterArray *pca, double x)
-{
-    if (!pca) {
-        SCLogDebug("counterarray is NULL");
-        return;
-    }
-    if ((id < 1) || (id > pca->size)) {
-        SCLogDebug("counter doesn't exist");
-        return;
-    }
-
-    /* incase you are trying to add a double to a counter of type SC_PERF_TYPE_UINT64
-     * it will be truncated */
-    switch (pca->head[id].pc->value->type) {
-        case SC_PERF_TYPE_UINT64:
-            pca->head[id].ui64_cnt += x;
-            break;
-        case SC_PERF_TYPE_DOUBLE:
-            pca->head[id].d_cnt += x;
-            break;
-    }
-
-    if (pca->head[id].syncs == ULONG_MAX) {
-        pca->head[id].syncs = 0;
-        pca->head[id].wrapped_syncs++;
-    }
-    pca->head[id].syncs++;
-
-    return;
-}
-
-/**
- * \brief Sets a value of type double to the local counter
- *
- * \param id  Index of the local counter in the counter array
- * \param pca Pointer to the SCPerfCounterArray
- * \param x   The value to set for the counter
- */
-inline void SCPerfCounterSetUI64(uint16_t id, SCPerfCounterArray *pca,
-                                 uint64_t x)
-{
-    if (!pca) {
-        SCLogDebug("counterarray is NULL");
-        return;
-    }
-
-    if ((id < 1) || (id > pca->size)) {
-        SCLogDebug("counter doesn't exist");
-        return;
-    }
-
-    switch (pca->head[id].pc->value->type) {
-        case SC_PERF_TYPE_UINT64:
-            if ( (pca->head[id].pc->type_q->type & SC_PERF_TYPE_Q_MAXIMUM) &&
-                 (x > pca->head[id].ui64_cnt)) {
-                pca->head[id].ui64_cnt = x;
-            } else if (pca->head[id].pc->type_q->type & SC_PERF_TYPE_Q_NORMAL) {
-                pca->head[id].ui64_cnt = x;
-            }
-
-            break;
-        case SC_PERF_TYPE_DOUBLE:
-            if ( (pca->head[id].pc->type_q->type & SC_PERF_TYPE_Q_MAXIMUM) &&
-                 (x > pca->head[id].d_cnt)) {
-                pca->head[id].d_cnt = x;
-            } else if (pca->head[id].pc->type_q->type & SC_PERF_TYPE_Q_NORMAL) {
-                pca->head[id].d_cnt = x;
-            }
-
-            break;
-    }
-
-    if (pca->head[id].syncs == ULONG_MAX) {
-        pca->head[id].syncs = 0;
-        pca->head[id].wrapped_syncs++;
-    }
-    pca->head[id].syncs++;
-
-    return;
-}
-
-/**
- * \brief Sets a local counter to an arg of type double
- *
- * \param id  Index of the local counter in the counter array
- * \param pca Pointer to the SCPerfCounterArray
- * \param x   The value to set for the counter
- */
-inline void SCPerfCounterSetDouble(uint16_t id, SCPerfCounterArray *pca,
-                                   double x)
-{
-    if (!pca) {
-        SCLogDebug("counterarray is NULL");
-        return;
-    }
-
-    if ((id < 1) || (id > pca->size)) {
-        SCLogDebug("counter doesn't exist");
-        return;
-    }
-
-    switch (pca->head[id].pc->value->type) {
-        case SC_PERF_TYPE_UINT64:
-            if ( (pca->head[id].pc->type_q->type & SC_PERF_TYPE_Q_MAXIMUM) &&
-                 (x > pca->head[id].ui64_cnt)) {
-                pca->head[id].ui64_cnt = x;
-            } else if (pca->head[id].pc->type_q->type & SC_PERF_TYPE_Q_NORMAL) {
-                pca->head[id].ui64_cnt = x;
-            }
-
-            break;
-        case SC_PERF_TYPE_DOUBLE:
-            if ( (pca->head[id].pc->type_q->type & SC_PERF_TYPE_Q_MAXIMUM) &&
-                 (x > pca->head[id].d_cnt)) {
-                pca->head[id].d_cnt = x;
-            } else if (pca->head[id].pc->type_q->type & SC_PERF_TYPE_Q_NORMAL) {
-                pca->head[id].d_cnt = x;
-            }
-
-            break;
-    }
-
-    if (pca->head[id].syncs == ULONG_MAX) {
-        pca->head[id].syncs = 0;
-        pca->head[id].wrapped_syncs++;
-    }
-    pca->head[id].syncs++;
-
-    return;
-}
-
-/**
  * \brief Syncs the counter array with the global counter variables
  *
  * \param pca      Pointer to the SCPerfCounterArray
diff --git a/src/counters.h b/src/counters.h
index ee6a908..e95dbf1 100644
--- a/src/counters.h
+++ b/src/counters.h
@@ -221,13 +221,6 @@ SCPerfCounterArray *SCPerfGetCounterArrayRange(uint16_t, uint16_t, SCPerfContext
 SCPerfCounterArray * SCPerfGetAllCountersArray(SCPerfContext *);
 int SCPerfCounterDisplay(uint16_t, SCPerfContext *, int);
 
-/* functions used to update local counter values */
-inline void SCPerfCounterIncr(uint16_t, SCPerfCounterArray *);
-inline void SCPerfCounterAddUI64(uint16_t, SCPerfCounterArray *, uint64_t);
-inline void SCPerfCounterAddDouble(uint16_t, SCPerfCounterArray *, double);
-inline void SCPerfCounterSetUI64(uint16_t, SCPerfCounterArray *, uint64_t);
-inline void SCPerfCounterSetDouble(uint16_t, SCPerfCounterArray *, double);
-
 int SCPerfUpdateCounterArray(SCPerfCounterArray *, SCPerfContext *, int);
 
 void SCPerfOutputCounters(void);
@@ -239,4 +232,218 @@ void SCPerfReleasePCA(SCPerfCounterArray *);
 
 void SCPerfRegisterTests(void);
 
+/** --------- Inline functions --------- */
+
+/* functions used to update local counter values */
+
+/**
+ * \brief Sets a local counter to an arg of type double
+ *
+ * \param id  Index of the local counter in the counter array
+ * \param pca Pointer to the SCPerfCounterArray
+ * \param x   The value to set for the counter
+ */
+static inline void SCPerfCounterSetDouble(uint16_t id, SCPerfCounterArray *pca,
+                                   double x)
+{
+    if (!pca) {
+        SCLogDebug("counterarray is NULL");
+        return;
+    }
+
+    if ((id < 1) || (id > pca->size)) {
+        SCLogDebug("counter doesn't exist");
+        return;
+    }
+
+    switch (pca->head[id].pc->value->type) {
+        case SC_PERF_TYPE_UINT64:
+            if ( (pca->head[id].pc->type_q->type & SC_PERF_TYPE_Q_MAXIMUM) &&
+                 (x > pca->head[id].ui64_cnt)) {
+                pca->head[id].ui64_cnt = x;
+            } else if (pca->head[id].pc->type_q->type & SC_PERF_TYPE_Q_NORMAL) {
+                pca->head[id].ui64_cnt = x;
+            }
+
+            break;
+        case SC_PERF_TYPE_DOUBLE:
+            if ( (pca->head[id].pc->type_q->type & SC_PERF_TYPE_Q_MAXIMUM) &&
+                 (x > pca->head[id].d_cnt)) {
+                pca->head[id].d_cnt = x;
+            } else if (pca->head[id].pc->type_q->type & SC_PERF_TYPE_Q_NORMAL) {
+                pca->head[id].d_cnt = x;
+            }
+
+            break;
+    }
+
+    if (pca->head[id].syncs == ULONG_MAX) {
+        pca->head[id].syncs = 0;
+        pca->head[id].wrapped_syncs++;
+    }
+    pca->head[id].syncs++;
+
+    return;
+}
+
+/**
+ * \brief Sets a value of type double to the local counter
+ *
+ * \param id  Index of the local counter in the counter array
+ * \param pca Pointer to the SCPerfCounterArray
+ * \param x   The value to set for the counter
+ */
+static inline void SCPerfCounterSetUI64(uint16_t id, SCPerfCounterArray *pca,
+                                 uint64_t x)
+{
+    if (!pca) {
+        SCLogDebug("counterarray is NULL");
+        return;
+    }
+
+    if ((id < 1) || (id > pca->size)) {
+        SCLogDebug("counter doesn't exist");
+        return;
+    }
+
+    switch (pca->head[id].pc->value->type) {
+        case SC_PERF_TYPE_UINT64:
+            if ( (pca->head[id].pc->type_q->type & SC_PERF_TYPE_Q_MAXIMUM) &&
+                 (x > pca->head[id].ui64_cnt)) {
+                pca->head[id].ui64_cnt = x;
+            } else if (pca->head[id].pc->type_q->type & SC_PERF_TYPE_Q_NORMAL) {
+                pca->head[id].ui64_cnt = x;
+            }
+
+            break;
+        case SC_PERF_TYPE_DOUBLE:
+            if ( (pca->head[id].pc->type_q->type & SC_PERF_TYPE_Q_MAXIMUM) &&
+                 (x > pca->head[id].d_cnt)) {
+                pca->head[id].d_cnt = x;
+            } else if (pca->head[id].pc->type_q->type & SC_PERF_TYPE_Q_NORMAL) {
+                pca->head[id].d_cnt = x;
+            }
+
+            break;
+    }
+
+    if (pca->head[id].syncs == ULONG_MAX) {
+        pca->head[id].syncs = 0;
+        pca->head[id].wrapped_syncs++;
+    }
+    pca->head[id].syncs++;
+
+    return;
+}
+
+/**
+ * \brief Adds a value of type double to the local counter
+ *
+ * \param id  ID of the counter as set by the API
+ * \param pca Counter array that holds the local counter for this TM
+ * \param x   Value to add to this local counter
+ */
+static inline void SCPerfCounterAddDouble(uint16_t id, SCPerfCounterArray *pca, double x)
+{
+    if (!pca) {
+        SCLogDebug("counterarray is NULL");
+        return;
+    }
+    if ((id < 1) || (id > pca->size)) {
+        SCLogDebug("counter doesn't exist");
+        return;
+    }
+
+    /* incase you are trying to add a double to a counter of type SC_PERF_TYPE_UINT64
+     * it will be truncated */
+    switch (pca->head[id].pc->value->type) {
+        case SC_PERF_TYPE_UINT64:
+            pca->head[id].ui64_cnt += x;
+            break;
+        case SC_PERF_TYPE_DOUBLE:
+            pca->head[id].d_cnt += x;
+            break;
+    }
+
+    if (pca->head[id].syncs == ULONG_MAX) {
+        pca->head[id].syncs = 0;
+        pca->head[id].wrapped_syncs++;
+    }
+    pca->head[id].syncs++;
+
+    return;
+}
+
+/**
+ * \brief Adds a value of type uint64_t to the local counter.
+ *
+ * \param id  ID of the counter as set by the API
+ * \param pca Counter array that holds the local counter for this TM
+ * \param x   Value to add to this local counter
+ */
+static inline void SCPerfCounterAddUI64(uint16_t id, SCPerfCounterArray *pca, uint64_t x)
+{
+    if (!pca) {
+        SCLogDebug("counterarray is NULL");
+        return;
+    }
+    if ((id < 1) || (id > pca->size)) {
+        SCLogDebug("counter doesn't exist");
+        return;
+    }
+
+    switch (pca->head[id].pc->value->type) {
+        case SC_PERF_TYPE_UINT64:
+            pca->head[id].ui64_cnt += x;
+            break;
+        case SC_PERF_TYPE_DOUBLE:
+            pca->head[id].d_cnt += x;
+            break;
+    }
+
+    if (pca->head[id].syncs == ULONG_MAX) {
+        pca->head[id].syncs = 0;
+        pca->head[id].wrapped_syncs++;
+    }
+    pca->head[id].syncs++;
+
+    return;
+}
+
+/**
+ * \brief Increments the local counter
+ *
+ * \param id  Index of the counter in the counter array
+ * \param pca Counter array that holds the local counters for this TM
+ */
+static inline void SCPerfCounterIncr(uint16_t id, SCPerfCounterArray *pca)
+{
+    if (pca == NULL) {
+        SCLogDebug("counterarray is NULL");
+        return;
+    }
+    if ((id < 1) || (id > pca->size)) {
+        SCLogDebug("counter doesn't exist");
+        return;
+    }
+
+    switch (pca->head[id].pc->value->type) {
+        case SC_PERF_TYPE_UINT64:
+            pca->head[id].ui64_cnt++;
+            break;
+        case SC_PERF_TYPE_DOUBLE:
+            pca->head[id].d_cnt++;
+            break;
+    }
+
+    if (pca->head[id].syncs == ULONG_MAX) {
+        pca->head[id].syncs = 0;
+        pca->head[id].wrapped_syncs++;
+    }
+    pca->head[id].syncs++;
+
+    return;
+}
+
+
 #endif /* __COUNTERS_H__ */
diff --git a/src/decode-icmpv4.c b/src/decode-icmpv4.c
index 43c1e80..07c53db 100644
--- a/src/decode-icmpv4.c
+++ b/src/decode-icmpv4.c
@@ -13,58 +13,6 @@
 #include "util-debug.h"
 
 /**
- * \brief Calculates the checksum for the ICMP packet
- *
- * \param pkt  Pointer to the start of the ICMP packet
- * \param hlen Total length of the ICMP packet(header + payload)
- *
- * \retval csum Checksum for the ICMP packet
- */
-inline uint16_t ICMPV4CalculateChecksum(uint16_t *pkt, uint16_t tlen)
-{
-    uint16_t pad = 0;
-    uint32_t csum = pkt[0];
-
-    tlen -= 4;
-    pkt += 2;
-
-    while (tlen >= 32) {
-        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
-            pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] +
-            pkt[14] + pkt[15];
-        tlen -= 32;
-        pkt += 16;
-    }
-
-    while(tlen >= 8) {
-        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3];
-        tlen -= 8;
-        pkt += 4;
-    }
-
-    while(tlen >= 4) {
-        csum += pkt[0] + pkt[1];
-        tlen -= 4;
-        pkt += 2;
-    }
-
-    while (tlen > 1) {
-        csum += pkt[0];
-        tlen -= 2;
-        pkt += 1;
-    }
-
-    if (tlen == 1) {
-        *(uint8_t *)(&pad) = (*(uint8_t *)pkt);
-        csum += pad;
-    }
-
-    csum = (csum >> 16) + (csum & 0x0000FFFF);
-
-    return (uint16_t) ~csum;
-}
-
-/**
  * Note, this is the IP header, plus a bit of the original packet, not the whole thing!
  */
 void DecodePartialIPV4( Packet* p, uint8_t* partial_packet, uint16_t len )
diff --git a/src/decode-icmpv4.h b/src/decode-icmpv4.h
index a864aa6..7d72a73 100644
--- a/src/decode-icmpv4.h
+++ b/src/decode-icmpv4.h
@@ -222,9 +222,63 @@ typedef struct ICMPV4Cache_ {
     int32_t comp_csum;
 } ICMPV4Cache;
 
-inline uint16_t ICMPV4CalculateChecksum(uint16_t *, uint16_t);
+static inline uint16_t ICMPV4CalculateChecksum(uint16_t *, uint16_t);
 
 void DecodeICMPV4RegisterTests(void);
 
+/** ------- inline functions ----- */
+/**
+ * \brief Calculates the checksum for the ICMP packet
+ *
+ * \param pkt  Pointer to the start of the ICMP packet
+ * \param hlen Total length of the ICMP packet(header + payload)
+ *
+ * \retval csum Checksum for the ICMP packet
+ */
+static inline uint16_t ICMPV4CalculateChecksum(uint16_t *pkt, uint16_t tlen)
+{
+    uint16_t pad = 0;
+    uint32_t csum = pkt[0];
+
+    tlen -= 4;
+    pkt += 2;
+
+    while (tlen >= 32) {
+        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
+            pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] +
+            pkt[14] + pkt[15];
+        tlen -= 32;
+        pkt += 16;
+    }
+
+    while(tlen >= 8) {
+        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3];
+        tlen -= 8;
+        pkt += 4;
+    }
+
+    while(tlen >= 4) {
+        csum += pkt[0] + pkt[1];
+        tlen -= 4;
+        pkt += 2;
+    }
+
+    while (tlen > 1) {
+        csum += pkt[0];
+        tlen -= 2;
+        pkt += 1;
+    }
+
+    if (tlen == 1) {
+        *(uint8_t *)(&pad) = (*(uint8_t *)pkt);
+        csum += pad;
+    }
+
+    csum = (csum >> 16) + (csum & 0x0000FFFF);
+
+    return (uint16_t) ~csum;
+}
+
+
 #endif /* __DECODE_ICMPV4_H__ */
 
diff --git a/src/decode-icmpv6.c b/src/decode-icmpv6.c
index 36512ae..8164f78 100644
--- a/src/decode-icmpv6.c
+++ b/src/decode-icmpv6.c
@@ -10,77 +10,6 @@
 #include "flow.h"
 #include "util-debug.h"
 
-/**
- * \brief Calculates the checksum for the ICMPV6 packet
- *
- * \param shdr Pointer to source address field from the IPV6 packet.  Used as a
- *             part of the psuedoheader for computing the checksum
- * \param pkt  Pointer to the start of the ICMPV6 packet
- * \param tlen Total length of the ICMPV6 packet(header + payload)
- *
- * \retval csum Checksum for the ICMPV6 packet
- */
-inline uint16_t ICMPV6CalculateChecksum(uint16_t *shdr, uint16_t *pkt,
-                                        uint16_t tlen)
-{
-    uint16_t pad = 0;
-    uint32_t csum = shdr[0];
-
-    csum += shdr[1] + shdr[2] + shdr[3] + shdr[4] + shdr[5] + shdr[6] +
-        shdr[7] + shdr[8] + shdr[9] + shdr[10] + shdr[11] + shdr[12] +
-        shdr[13] + shdr[14] + shdr[15] + htons(58 + tlen);
-
-    csum += pkt[0];
-
-    tlen -= 4;
-    pkt += 2;
-
-    while (tlen >= 64) {
-        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
-            pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] +
-            pkt[14] + pkt[15] + pkt[16] + pkt[17] + pkt[18] + pkt[19] +
-            pkt[20] + pkt[21] + pkt[22] + pkt[23] + pkt[24] + pkt[25] +
-            pkt[26] + pkt[27] + pkt[28] + pkt[29] + pkt[30] + pkt[31];
-        tlen -= 64;
-        pkt += 32;
-    }
-
-    while (tlen >= 32) {
-        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
-            pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] +
-            pkt[14] + pkt[15];
-        tlen -= 32;
-        pkt += 16;
-    }
-
-    while(tlen >= 8) {
-        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3];
-        tlen -= 8;
-        pkt += 4;
-    }
-
-    while(tlen >= 4) {
-        csum += pkt[0] + pkt[1];
-        tlen -= 4;
-        pkt += 2;
-    }
-
-    while (tlen > 1) {
-        csum += pkt[0];
-        tlen -= 2;
-        pkt += 1;
-    }
-
-    if (tlen == 1) {
-        *(uint8_t *)(&pad) = (*(uint8_t *)pkt);
-        csum += pad;
-    }
-
-    csum = (csum >> 16) + (csum & 0x0000FFFF);
-
-    return (uint16_t) ~csum;
-}
-
 
 /**
  * \brief Get variables and do some checks of the embedded IPV6 packet
diff --git a/src/decode-icmpv6.h b/src/decode-icmpv6.h
index f453742..f287b18 100644
--- a/src/decode-icmpv6.h
+++ b/src/decode-icmpv6.h
@@ -139,8 +139,82 @@ typedef struct ICMPV6Vars_ {
 
 } ICMPV6Vars;
 
-inline uint16_t ICMPV6CalculateChecksum(uint16_t *, uint16_t *, uint16_t);
+static inline uint16_t ICMPV6CalculateChecksum(uint16_t *, uint16_t *, uint16_t);
 void DecodeICMPV6RegisterTests(void);
 
+/** ------ inline functions ------ */
+
+/**
+ * \brief Calculates the checksum for the ICMPV6 packet
+ *
+ * \param shdr Pointer to source address field from the IPV6 packet.  Used as a
+ *             part of the psuedoheader for computing the checksum
+ * \param pkt  Pointer to the start of the ICMPV6 packet
+ * \param tlen Total length of the ICMPV6 packet(header + payload)
+ *
+ * \retval csum Checksum for the ICMPV6 packet
+ */
+static inline uint16_t ICMPV6CalculateChecksum(uint16_t *shdr, uint16_t *pkt,
+                                        uint16_t tlen)
+{
+    uint16_t pad = 0;
+    uint32_t csum = shdr[0];
+
+    csum += shdr[1] + shdr[2] + shdr[3] + shdr[4] + shdr[5] + shdr[6] +
+        shdr[7] + shdr[8] + shdr[9] + shdr[10] + shdr[11] + shdr[12] +
+        shdr[13] + shdr[14] + shdr[15] + htons(58 + tlen);
+
+    csum += pkt[0];
+
+    tlen -= 4;
+    pkt += 2;
+
+    while (tlen >= 64) {
+        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
+            pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] +
+            pkt[14] + pkt[15] + pkt[16] + pkt[17] + pkt[18] + pkt[19] +
+            pkt[20] + pkt[21] + pkt[22] + pkt[23] + pkt[24] + pkt[25] +
+            pkt[26] + pkt[27] + pkt[28] + pkt[29] + pkt[30] + pkt[31];
+        tlen -= 64;
+        pkt += 32;
+    }
+
+    while (tlen >= 32) {
+        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
+            pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] +
+            pkt[14] + pkt[15];
+        tlen -= 32;
+        pkt += 16;
+    }
+
+    while(tlen >= 8) {
+        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3];
+        tlen -= 8;
+        pkt += 4;
+    }
+
+    while(tlen >= 4) {
+        csum += pkt[0] + pkt[1];
+        tlen -= 4;
+        pkt += 2;
+    }
+
+    while (tlen > 1) {
+        csum += pkt[0];
+        tlen -= 2;
+        pkt += 1;
+    }
+
+    if (tlen == 1) {
+        *(uint8_t *)(&pad) = (*(uint8_t *)pkt);
+        csum += pad;
+    }
+
+    csum = (csum >> 16) + (csum & 0x0000FFFF);
+
+    return (uint16_t) ~csum;
+}
+
+
 #endif /* __DECODE_ICMPV6_H__ */
 
diff --git a/src/decode-ipv4.c b/src/decode-ipv4.c
index f08c7f6..c716d97 100644
--- a/src/decode-ipv4.c
+++ b/src/decode-ipv4.c
@@ -13,62 +13,8 @@
 #include "util-unittest.h"
 #include "util-debug.h"
 
-/**
- * \brief Calculates the checksum for the IP packet
- *
- * \param pkt  Pointer to the start of the IP packet
- * \param hlen Length of the IP header
- *
- * \retval csum Checksum for the IP packet
- */
-inline uint16_t IPV4CalculateChecksum(uint16_t *pkt, uint16_t hlen)
-{
-    uint32_t csum = pkt[0];
+static uint16_t IPV4CalculateChecksum(uint16_t *pkt, uint16_t hlen);
 
-    csum += pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[6] + pkt[7] + pkt[8] +
-        pkt[9];
-
-    hlen -= 20;
-    pkt += 10;
-
-    if (hlen == 0) {
-        ;
-    }
-    if (hlen == 4)
-        csum += pkt[0] + pkt[1];
-    else if (hlen == 8)
-        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3];
-    else if (hlen == 12)
-        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5];
-    else if (hlen == 16)
-        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
-            pkt[7];
-    else if (hlen == 20)
-        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
-            pkt[7] + pkt[8] + pkt[9];
-    else if (hlen == 24)
-        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
-            pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11];
-    else if (hlen == 28)
-        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
-            pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13];
-    else if (hlen == 32)
-        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
-            pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] +
-            pkt[14] + pkt[15];
-    if (hlen == 36)
-        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
-            pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] +
-            pkt[14] + pkt[15] + pkt[16] + pkt[17];
-    if (hlen == 40)
-        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
-            pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] +
-            pkt[14] + pkt[15] + pkt[16] + pkt[17] + pkt[18] + pkt[19];
-
-    csum = (csum >> 16) + (csum & 0x0000FFFF);
-
-    return (uint16_t) ~csum;
-}
 
 /* Generic validation
  *
diff --git a/src/decode-ipv4.h b/src/decode-ipv4.h
index d72b036..8fda864 100644
--- a/src/decode-ipv4.h
+++ b/src/decode-ipv4.h
@@ -186,8 +186,67 @@ typedef struct IPV4Vars_
     IPV4Opt *o_rtralt;
 } IPV4Vars;
 
-inline uint16_t IPV4CalculateChecksum(uint16_t *, uint16_t);
 void DecodeIPV4RegisterTests(void);
 
+/** ------ inline functions ------ */
+
+/**
+ * \brief Calculates the checksum for the IP packet
+ *
+ * \param pkt  Pointer to the start of the IP packet
+ * \param hlen Length of the IP header
+ *
+ * \retval csum Checksum for the IP packet
+ */
+static inline uint16_t IPV4CalculateChecksum(uint16_t *pkt, uint16_t hlen)
+{
+    uint32_t csum = pkt[0];
+
+    csum += pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[6] + pkt[7] + pkt[8] +
+        pkt[9];
+
+    hlen -= 20;
+    pkt += 10;
+
+    if (hlen == 0) {
+        ;
+    }
+    if (hlen == 4)
+        csum += pkt[0] + pkt[1];
+    else if (hlen == 8)
+        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3];
+    else if (hlen == 12)
+        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5];
+    else if (hlen == 16)
+        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
+            pkt[7];
+    else if (hlen == 20)
+        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
+            pkt[7] + pkt[8] + pkt[9];
+    else if (hlen == 24)
+        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
+            pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11];
+    else if (hlen == 28)
+        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
+            pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13];
+    else if (hlen == 32)
+        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
+            pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] +
+            pkt[14] + pkt[15];
+    if (hlen == 36)
+        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
+            pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] +
+            pkt[14] + pkt[15] + pkt[16] + pkt[17];
+    if (hlen == 40)
+        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
+            pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] +
+            pkt[14] + pkt[15] + pkt[16] + pkt[17] + pkt[18] + pkt[19];
+
+    csum = (csum >> 16) + (csum & 0x0000FFFF);
+
+    return (uint16_t) ~csum;
+}
+
+
 #endif /* __DECODE_IPV4_H__ */
 
diff --git a/src/decode-tcp.c b/src/decode-tcp.c
index 46ec32e..e132cab 100644
--- a/src/decode-tcp.c
+++ b/src/decode-tcp.c
@@ -8,128 +8,6 @@
 #include "util-debug.h"
 #include "flow.h"
 
-/**
- * \brief Calculates the checksum for the TCP packet
- *
- * \param shdr Pointer to source address field from the IP packet.  Used as a
- *             part of the psuedoheader for computing the checksum
- * \param pkt  Pointer to the start of the TCP packet
- * \param hlen Total length of the TCP packet(header + payload)
- *
- * \retval csum Checksum for the TCP packet
- */
-inline uint16_t TCPCalculateChecksum(uint16_t *shdr, uint16_t *pkt,
-                                     uint16_t tlen)
-{
-    uint16_t pad = 0;
-    uint32_t csum = shdr[0];
-
-    csum += shdr[1] + shdr[2] + shdr[3] + htons(6 + tlen);
-
-    csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
-        pkt[7] + pkt[9];
-
-    tlen -= 20;
-    pkt += 10;
-
-    while (tlen >= 32) {
-        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
-            pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] +
-            pkt[14] + pkt[15];
-        tlen -= 32;
-        pkt += 16;
-    }
-
-    while(tlen >= 8) {
-        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3];
-        tlen -= 8;
-        pkt += 4;
-    }
-
-    while(tlen >= 4) {
-        csum += pkt[0] + pkt[1];
-        tlen -= 4;
-        pkt += 2;
-    }
-
-    while (tlen > 1) {
-        csum += pkt[0];
-        pkt += 1;
-        tlen -= 2;
-    }
-
-    if (tlen == 1) {
-        *(uint8_t *)(&pad) = (*(uint8_t *)pkt);
-        csum += pad;
-    }
-
-    csum = (csum >> 16) + (csum & 0x0000FFFF);
-
-    return (uint16_t) ~csum;
-}
-
-/**
- * \brief Calculates the checksum for the TCP packet
- *
- * \param shdr Pointer to source address field from the IPV6 packet.  Used as a
- *             part of the psuedoheader for computing the checksum
- * \param pkt  Pointer to the start of the TCP packet
- * \param tlen Total length of the TCP packet(header + payload)
- *
- * \retval csum Checksum for the TCP packet
- */
-inline uint16_t TCPV6CalculateChecksum(uint16_t *shdr, uint16_t *pkt,
-                                       uint16_t tlen)
-{
-    uint16_t pad = 0;
-    uint32_t csum = shdr[0];
-
-    csum += shdr[1] + shdr[2] + shdr[3] + shdr[4] + shdr[5] + shdr[6] +
-        shdr[7] + shdr[8] + shdr[9] + shdr[10] + shdr[11] + shdr[12] +
-        shdr[13] + shdr[14] + shdr[15] + htons(6 + tlen);
-
-    csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
-        pkt[7] + pkt[9];
-
-    tlen -= 20;
-    pkt += 10;
-
-    while (tlen >= 32) {
-        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
-            pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] +
-            pkt[14] + pkt[15];
-        tlen -= 32;
-        pkt += 16;
-    }
-
-    while(tlen >= 8) {
-        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3];
-        tlen -= 8;
-        pkt += 4;
-    }
-
-    while(tlen >= 4) {
-        csum += pkt[0] + pkt[1];
-        tlen -= 4;
-        pkt += 2;
-    }
-
-    while (tlen > 1) {
-        csum += pkt[0];
-        pkt += 1;
-        tlen -= 2;
-    }
-
-    if (tlen == 1) {
-        *(uint8_t *)(&pad) = (*(uint8_t *)pkt);
-        csum += pad;
-    }
-
-    csum = (csum >> 16) + (csum & 0x0000FFFF);
-
-    return (uint16_t) ~csum;
-}
-
 static int DecodeTCPOptions(ThreadVars *tv, Packet *p, uint8_t *pkt, uint16_t len)
 {
     uint16_t plen = len;
diff --git a/src/decode-tcp.h b/src/decode-tcp.h
index 413de1b..9195dfe 100644
--- a/src/decode-tcp.h
+++ b/src/decode-tcp.h
@@ -137,9 +137,134 @@ typedef struct TCPCache_ {
     (p)->tcpc.ts2 = 0; \
 }
 
-inline uint16_t TCPCalculateChecksum(uint16_t *, uint16_t *, uint16_t);
-inline uint16_t TCPV6CalculateChecksum(uint16_t *, uint16_t *, uint16_t);
+static inline uint16_t TCPCalculateChecksum(uint16_t *, uint16_t *, uint16_t);
+static inline uint16_t TCPV6CalculateChecksum(uint16_t *, uint16_t *, uint16_t);
 void DecodeTCPRegisterTests(void);
 
+/** ------ inline functions ------ */
+
+/**
+ * \brief Calculates the checksum for the TCP packet
+ *
+ * \param shdr Pointer to source address field from the IP packet.  Used as a
+ *             part of the psuedoheader for computing the checksum
+ * \param pkt  Pointer to the start of the TCP packet
+ * \param hlen Total length of the TCP packet(header + payload)
+ *
+ * \retval csum Checksum for the TCP packet
+ */
+static inline uint16_t TCPCalculateChecksum(uint16_t *shdr, uint16_t *pkt,
+                                     uint16_t tlen)
+{
+    uint16_t pad = 0;
+    uint32_t csum = shdr[0];
+
+    csum += shdr[1] + shdr[2] + shdr[3] + htons(6 + tlen);
+
+    csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
+        pkt[7] + pkt[9];
+
+    tlen -= 20;
+    pkt += 10;
+
+    while (tlen >= 32) {
+        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
+            pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] +
+            pkt[14] + pkt[15];
+        tlen -= 32;
+        pkt += 16;
+    }
+
+    while(tlen >= 8) {
+        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3];
+        tlen -= 8;
+        pkt += 4;
+    }
+
+    while(tlen >= 4) {
+        csum += pkt[0] + pkt[1];
+        tlen -= 4;
+        pkt += 2;
+    }
+
+    while (tlen > 1) {
+        csum += pkt[0];
+        pkt += 1;
+        tlen -= 2;
+    }
+
+    if (tlen == 1) {
+        *(uint8_t *)(&pad) = (*(uint8_t *)pkt);
+        csum += pad;
+    }
+
+    csum = (csum >> 16) + (csum & 0x0000FFFF);
+
+    return (uint16_t) ~csum;
+}
+
+/**
+ * \brief Calculates the checksum for the TCP packet
+ *
+ * \param shdr Pointer to source address field from the IPV6 packet.  Used as a
+ *             part of the psuedoheader for computing the checksum
+ * \param pkt  Pointer to the start of the TCP packet
+ * \param tlen Total length of the TCP packet(header + payload)
+ *
+ * \retval csum Checksum for the TCP packet
+ */
+static inline uint16_t TCPV6CalculateChecksum(uint16_t *shdr, uint16_t *pkt,
+                                       uint16_t tlen)
+{
+    uint16_t pad = 0;
+    uint32_t csum = shdr[0];
+
+    csum += shdr[1] + shdr[2] + shdr[3] + shdr[4] + shdr[5] + shdr[6] +
+        shdr[7] + shdr[8] + shdr[9] + shdr[10] + shdr[11] + shdr[12] +
+        shdr[13] + shdr[14] + shdr[15] + htons(6 + tlen);
+
+    csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
+        pkt[7] + pkt[9];
+
+    tlen -= 20;
+    pkt += 10;
+
+    while (tlen >= 32) {
+        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
+            pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] +
+            pkt[14] + pkt[15];
+        tlen -= 32;
+        pkt += 16;
+    }
+
+    while(tlen >= 8) {
+        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3];
+        tlen -= 8;
+        pkt += 4;
+    }
+
+    while(tlen >= 4) {
+        csum += pkt[0] + pkt[1];
+        tlen -= 4;
+        pkt += 2;
+    }
+
+    while (tlen > 1) {
+        csum += pkt[0];
+        pkt += 1;
+        tlen -= 2;
+    }
+
+    if (tlen == 1) {
+        *(uint8_t *)(&pad) = (*(uint8_t *)pkt);
+        csum += pad;
+    }
+
+    csum = (csum >> 16) + (csum & 0x0000FFFF);
+
+    return (uint16_t) ~csum;
+}
+
+
 #endif /* __DECODE_TCP_H__ */
 
diff --git a/src/decode-udp.c b/src/decode-udp.c
index 7753e9b..12b093f 100644
--- a/src/decode-udp.c
+++ b/src/decode-udp.c
@@ -8,126 +8,6 @@
 #include "util-debug.h"
 #include "flow.h"
 
-/**
- * \brief Calculates the checksum for the UDP packet
- *
- * \param shdr Pointer to source address field from the IP packet.  Used as a
- *             part of the psuedoheader for computing the checksum
- * \param pkt  Pointer to the start of the UDP packet
- * \param hlen Total length of the UDP packet(header + payload)
- *
- * \retval csum Checksum for the UDP packet
- */
-inline uint16_t UDPV4CalculateChecksum(uint16_t *shdr, uint16_t *pkt,
-                                       uint16_t tlen)
-{
-    uint16_t pad = 0;
-    uint32_t csum = shdr[0];
-
-    csum += shdr[1] + shdr[2] + shdr[3] + htons(17 + tlen);
-
-    csum += pkt[0] + pkt[1] + pkt[2];
-
-    tlen -= 8;
-    pkt += 4;
-
-    while (tlen >= 32) {
-        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
-            pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] +
-            pkt[14] + pkt[15];
-        tlen -= 32;
-        pkt += 16;
-    }
-
-    while(tlen >= 8) {
-        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3];
-        tlen -= 8;
-        pkt += 4;
-    }
-
-    while(tlen >= 4) {
-        csum += pkt[0] + pkt[1];
-        tlen -= 4;
-        pkt += 2;
-    }
-
-    while (tlen > 1) {
-        csum += pkt[0];
-        pkt += 1;
-        tlen -= 2;
-    }
-
-    if (tlen == 1) {
-        *(uint8_t *)(&pad) = (*(uint8_t *)pkt);
-        csum += pad;
-    }
-
-    csum = (csum >> 16) + (csum & 0x0000FFFF);
-
-    return (uint16_t) ~csum;
-}
-
-/**
- * \brief Calculates the checksum for the UDP packet
- *
- * \param shdr Pointer to source address field from the IPV6 packet.  Used as a
- *             part of the psuedoheader for computing the checksum
- * \param pkt  Pointer to the start of the UDP packet
- * \param tlen Total length of the UDP packet(header + payload)
- *
- * \retval csum Checksum for the UDP packet
- */
-inline uint16_t UDPV6CalculateChecksum(uint16_t *shdr, uint16_t *pkt,
-                                       uint16_t tlen)
-{
-    uint16_t pad = 0;
-    uint32_t csum = shdr[0];
-
-    csum += shdr[1] + shdr[2] + shdr[3] + shdr[4] + shdr[5] + shdr[6] +
-        shdr[7] + shdr[8] + shdr[9] + shdr[10] + shdr[11] + shdr[12] +
-        shdr[13] + shdr[14] + shdr[15] + htons(17 + tlen);
-
-    csum += pkt[0] + pkt[1] + pkt[2];
-
-    tlen -= 8;
-    pkt += 4;
-
-    while (tlen >= 32) {
-        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
-            pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] +
-            pkt[14] + pkt[15];
-        tlen -= 32;
-        pkt += 16;
-    }
-
-    while(tlen >= 8) {
-        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3];
-        tlen -= 8;
-        pkt += 4;
-    }
-
-    while(tlen >= 4) {
-        csum += pkt[0] + pkt[1];
-        tlen -= 4;
-        pkt += 2;
-    }
-
-    while (tlen > 1) {
-        csum += pkt[0];
-        pkt += 1;
-        tlen -= 2;
-    }
-
-    if (tlen == 1) {
-        *(uint8_t *)(&pad) = (*(uint8_t *)pkt);
-        csum += pad;
-    }
-
-    csum = (csum >> 16) + (csum & 0x0000FFFF);
-
-    return (uint16_t) ~csum;
-}
-
 static int DecodeUDPPacket(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len)
 {
     if (len < UDP_HEADER_LEN) {
diff --git a/src/decode-udp.h b/src/decode-udp.h
index 691f2f8..833fb8c 100644
--- a/src/decode-udp.h
+++ b/src/decode-udp.h
@@ -33,8 +33,131 @@ typedef struct UDPCache_ {
     int32_t comp_csum;
 } UDPCache;
 
-inline uint16_t UDPV4CalculateChecksum(uint16_t *, uint16_t *, uint16_t);
-inline uint16_t UDPV6CalculateChecksum(uint16_t *, uint16_t *, uint16_t);
+static inline uint16_t UDPV4CalculateChecksum(uint16_t *, uint16_t *, uint16_t);
+static inline uint16_t UDPV6CalculateChecksum(uint16_t *, uint16_t *, uint16_t);
 void DecodeUDPV4RegisterTests(void);
 
+/** ------ inline functions ------ */
+
+/**
+ * \brief Calculates the checksum for the UDP packet
+ *
+ * \param shdr Pointer to source address field from the IP packet.  Used as a
+ *             part of the psuedoheader for computing the checksum
+ * \param pkt  Pointer to the start of the UDP packet
+ * \param hlen Total length of the UDP packet(header + payload)
+ *
+ * \retval csum Checksum for the UDP packet
+ */
+static inline uint16_t UDPV4CalculateChecksum(uint16_t *shdr, uint16_t *pkt,
+                                       uint16_t tlen)
+{
+    uint16_t pad = 0;
+    uint32_t csum = shdr[0];
+
+    csum += shdr[1] + shdr[2] + shdr[3] + htons(17 + tlen);
+
+    csum += pkt[0] + pkt[1] + pkt[2];
+
+    tlen -= 8;
+    pkt += 4;
+
+    while (tlen >= 32) {
+        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
+            pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] +
+            pkt[14] + pkt[15];
+        tlen -= 32;
+        pkt += 16;
+    }
+
+    while(tlen >= 8) {
+        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3];
+        tlen -= 8;
+        pkt += 4;
+    }
+
+    while(tlen >= 4) {
+        csum += pkt[0] + pkt[1];
+        tlen -= 4;
+        pkt += 2;
+    }
+
+    while (tlen > 1) {
+        csum += pkt[0];
+        pkt += 1;
+        tlen -= 2;
+    }
+
+    if (tlen == 1) {
+        *(uint8_t *)(&pad) = (*(uint8_t *)pkt);
+        csum += pad;
+    }
+
+    csum = (csum >> 16) + (csum & 0x0000FFFF);
+
+    return (uint16_t) ~csum;
+}
+
+/**
+ * \brief Calculates the checksum for the UDP packet
+ *
+ * \param shdr Pointer to source address field from the IPV6 packet.  Used as a
+ *             part of the psuedoheader for computing the checksum
+ * \param pkt  Pointer to the start of the UDP packet
+ * \param tlen Total length of the UDP packet(header + payload)
+ *
+ * \retval csum Checksum for the UDP packet
+ */
+static inline uint16_t UDPV6CalculateChecksum(uint16_t *shdr, uint16_t *pkt,
+                                       uint16_t tlen)
+{
+    uint16_t pad = 0;
+    uint32_t csum = shdr[0];
+
+    csum += shdr[1] + shdr[2] + shdr[3] + shdr[4] + shdr[5] + shdr[6] +
+        shdr[7] + shdr[8] + shdr[9] + shdr[10] + shdr[11] + shdr[12] +
+        shdr[13] + shdr[14] + shdr[15] + htons(17 + tlen);
+
+    csum += pkt[0] + pkt[1] + pkt[2];
+
+    tlen -= 8;
+    pkt += 4;
+
+    while (tlen >= 32) {
+        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3] + pkt[4] + pkt[5] + pkt[6] +
+            pkt[7] + pkt[8] + pkt[9] + pkt[10] + pkt[11] + pkt[12] + pkt[13] +
+            pkt[14] + pkt[15];
+        tlen -= 32;
+        pkt += 16;
+    }
+
+    while(tlen >= 8) {
+        csum += pkt[0] + pkt[1] + pkt[2] + pkt[3];
+        tlen -= 8;
+        pkt += 4;
+    }
+
+    while(tlen >= 4) {
+        csum += pkt[0] + pkt[1];
+        tlen -= 4;
+        pkt += 2;
+    }
+
+    while (tlen > 1) {
+        csum += pkt[0];
+        pkt += 1;
+        tlen -= 2;
+    }
+
+    if (tlen == 1) {
+        *(uint8_t *)(&pad) = (*(uint8_t *)pkt);
+        csum += pad;
+    }
+
+    csum = (csum >> 16) + (csum & 0x0000FFFF);
+
+    return (uint16_t) ~csum;
+}
+
+
 #endif /* __DECODE_UDP_H__ */
diff --git a/src/decode.c b/src/decode.c
index 26a6858..7112704 100644
--- a/src/decode.c
+++ b/src/decode.c
@@ -23,26 +23,6 @@ void DecodeTunnel(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt
     }
 }
 
-/** \brief Set the No payload inspection Flag for the packet.
- *
- * \param p Packet to set the flag in
- */
-inline void DecodeSetNoPayloadInspectionFlag(Packet *p) {
-    SCEnter();
-    p->flags |= PKT_NOPAYLOAD_INSPECTION;
-    SCReturn;
-}
-
-/** \brief Set the No packet inspection Flag for the packet.
- *
- * \param p Packet to set the flag in
- */
-inline void DecodeSetNoPacketInspectionFlag(Packet *p) {
-    SCEnter();
-    p->flags |= PKT_NOPACKET_INSPECTION;
-    SCReturn;
-}
-
 void DecodeRegisterPerfCounters(DecodeThreadVars *dtv, ThreadVars *tv)
 {
     /* register counters */
diff --git a/src/decode.h b/src/decode.h
index ee245aa..0aa2af2 100644
--- a/src/decode.h
+++ b/src/decode.h
@@ -499,9 +499,6 @@ void DecodeVLAN(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t,
 Packet *SetupPkt (void);
 Packet *TunnelPktSetup(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t, uint8_t);
 
-inline void DecodeSetNoPayloadInspectionFlag(Packet *);
-inline void DecodeSetNoPacketInspectionFlag(Packet *);
-
 #define DECODER_SET_EVENT(p, e)   ((p)->events[(e/8)] |= (1<<(e%8)))
 #define DECODER_ISSET_EVENT(p, e) ((p)->events[(e/8)] & (1<<(e%8)))
 
@@ -541,5 +538,30 @@ inline void DecodeSetNoPacketInspectionFlag(Packet *);
 #define PKT_NOPACKET_INSPECTION         0x01    /**< Flag to indicate that packet header or contents should not be inspected*/
 #define PKT_NOPAYLOAD_INSPECTION        0x02    /**< Flag to indicate that packet contents should not be inspected*/
 
+/** ------ inline functions ------ */
+static inline void DecodeSetNoPayloadInspectionFlag(Packet *);
+static inline void DecodeSetNoPacketInspectionFlag(Packet *);
+
+/** \brief Set the No payload inspection Flag for the packet.
+ *
+ * \param p Packet to set the flag in
+ */
+static inline void DecodeSetNoPayloadInspectionFlag(Packet *p) {
+    SCEnter();
+    p->flags |= PKT_NOPAYLOAD_INSPECTION;
+    SCReturn;
+}
+
+/** \brief Set the No packet inspection Flag for the packet.
+ *
+ * \param p Packet to set the flag in
+ */
+static inline void DecodeSetNoPacketInspectionFlag(Packet *p) {
+    SCEnter();
+    p->flags |= PKT_NOPACKET_INSPECTION;
+    SCReturn;
+}
+
+
 #endif /* __DECODE_H__ */
 
diff --git a/src/detect-classtype.c b/src/detect-classtype.c
index 685fd96..3e77995 100644
--- a/src/detect-classtype.c
+++ b/src/detect-classtype.c
@@ -25,47 +25,13 @@ int DetectClasstypeSetup(DetectEngineCtx *, Signature *, SigMatch *, char *);
 void DetectClasstypeRegisterTests(void);
 
 /**
- * \brief Registers the handler functions for the "Classtype" keyword.
- */
-void DetectClasstypeRegister(void)
-{
-    const char *eb = NULL;
-    int eo;
-    int opts = 0;
-
-    SCLogDebug("Registering the Classtype keyword handler");
-
-    sigmatch_table[DETECT_CLASSTYPE].name = "classtype";
-    sigmatch_table[DETECT_CLASSTYPE].Match = NULL;
-    sigmatch_table[DETECT_CLASSTYPE].Setup = DetectClasstypeSetup;
-    sigmatch_table[DETECT_CLASSTYPE].Free  = NULL;
-    sigmatch_table[DETECT_CLASSTYPE].RegisterTests = DetectClasstypeRegisterTests;
-
-    regex = pcre_compile(DETECT_CLASSTYPE_REGEX, opts, &eb, &eo, NULL);
-    if (regex == NULL) {
-        SCLogError(SC_ERR_PCRE_COMPILE, "Compile of \"%s\" failed at offset %" PRId32 ": %s",
-                   DETECT_CLASSTYPE_REGEX, eo, eb);
-        goto end;
-    }
-
-    regex_study = pcre_study(regex, 0, &eb);
-    if (eb != NULL) {
-        SCLogError(SC_ERR_PCRE_STUDY, "pcre study failed: %s", eb);
-        goto end;
-    }
-
- end:
-    return;
-}
-
-/**
  * \brief Parses the raw string supplied with the "Classtype" keyword.
  *
  * \param Pointer to the string to be parsed.
  *
  * \retval ct_name Pointer to the parsed string on Success; NULL on failure.
  */
-static inline const char *DetectClasstypeParseRawString(char *rawstr)
+static const char *DetectClasstypeParseRawString(char *rawstr)
 {
     const char *ct_name = NULL;
 #define MAX_SUBSTRINGS 30
@@ -98,25 +64,37 @@ static inline const char *DetectClasstypeParseRawString(char *rawstr)
 }
 
 /**
- * \brief Gets the classtype from the corresponding hash table stored
- *        in the Detection Engine Context, given the classtype name.
- *
- * \param ct_name Pointer to the classtype name that has to be looked up.
- * \param de_ctx  Pointer to the Detection Engine Context.
- *
- * \retval lookup_ct_info Pointer to the SCClassConfClasstype instance from
- *                        the hash table on success; NULL on failure.
+ * \brief Registers the handler functions for the "Classtype" keyword.
  */
-static inline SCClassConfClasstype *DetectClasstypeGetClasstypeInfo(const char *ct_name,
-                                                                    DetectEngineCtx *de_ctx)
+void DetectClasstypeRegister(void)
 {
-    SCClassConfClasstype *ct_info = SCClassConfAllocClasstype(ct_name, NULL,
-                                                              0);
-    SCClassConfClasstype *lookup_ct_info = HashTableLookup(de_ctx->class_conf_ht,
-                                                           ct_info, 0);
+    const char *eb = NULL;
+    int eo;
+    int opts = 0;
+
+    SCLogDebug("Registering the Classtype keyword handler");
+
+    sigmatch_table[DETECT_CLASSTYPE].name = "classtype";
+    sigmatch_table[DETECT_CLASSTYPE].Match = NULL;
+    sigmatch_table[DETECT_CLASSTYPE].Setup = DetectClasstypeSetup;
+    sigmatch_table[DETECT_CLASSTYPE].Free  = NULL;
+    sigmatch_table[DETECT_CLASSTYPE].RegisterTests = DetectClasstypeRegisterTests;
+
+    regex = pcre_compile(DETECT_CLASSTYPE_REGEX, opts, &eb, &eo, NULL);
+    if (regex == NULL) {
+        SCLogError(SC_ERR_PCRE_COMPILE, "Compile of \"%s\" failed at offset %" PRId32 ": %s",
+                   DETECT_CLASSTYPE_REGEX, eo, eb);
+        goto end;
+    }
 
-    SCClassConfDeAllocClasstype(ct_info);
-    return lookup_ct_info;
+    regex_study = pcre_study(regex, 0, &eb);
+    if (eb != NULL) {
+        SCLogError(SC_ERR_PCRE_STUDY, "pcre study failed: %s", eb);
+        goto end;
+    }
+
+ end:
+    return;
 }
 
 /**
diff --git a/src/detect-classtype.h b/src/detect-classtype.h
index 5c11e3b..fd410c2 100644
--- a/src/detect-classtype.h
+++ b/src/detect-classtype.h
@@ -5,8 +5,39 @@
 #ifndef __DETECT_CLASSTYPE_H__
 #define __DETECT_CLASSTYPE_H__
 
+#include <pcre.h>
+#include "suricata-common.h"
+#include "detect.h"
+#include "util-classification-config.h"
+
 /* prototypes */
 void DetectClasstypeRegister(void);
 
+/** ------ inline functions ------ */
+
+/**
+ * \brief Gets the classtype from the corresponding hash table stored
+ *        in the Detection Engine Context, given the classtype name.
+ *
+ * \param ct_name Pointer to the classtype name that has to be looked up.
+ * \param de_ctx  Pointer to the Detection Engine Context.
+ *
+ * \retval lookup_ct_info Pointer to the SCClassConfClasstype instance from
+ *                        the hash table on success; NULL on failure.
+ */
+static inline SCClassConfClasstype *DetectClasstypeGetClasstypeInfo(const char *ct_name,
+                                                                    DetectEngineCtx *de_ctx)
+{
+    SCClassConfClasstype *ct_info = SCClassConfAllocClasstype(ct_name, NULL,
+                                                              0);
+    SCClassConfClasstype *lookup_ct_info = HashTableLookup(de_ctx->class_conf_ht,
+                                                           ct_info, 0);
+
+    SCClassConfDeAllocClasstype(ct_info);
+    return lookup_ct_info;
+}
+
+
+
 #endif /* __DETECT_CLASSTYPE_H__ */
 
diff --git a/src/detect-content.c b/src/detect-content.c
index c924679..8e925fb 100644
--- a/src/detect-content.c
+++ b/src/detect-content.c
@@ -103,61 +103,6 @@ static void DetectContentPrintMatches(DetectEngineThreadCtx *det_ctx, DetectCont
 }
 #endif
 
-static inline int
-TestOffsetDepth(MpmMatch *m, DetectContentData *co, uint16_t pktoff) {
-    SCEnter();
-
-    if (m->offset >= pktoff) {
-        if (co->offset == 0 || (m->offset >= co->offset)) {
-            if (co->depth == 0 || ((m->offset + co->content_len) <= co->depth)) {
-                SCLogDebug("depth %" PRIu32 ", offset %" PRIu32 ", m->offset "
-                           "%" PRIu32 ", return 1", co->depth, co->offset,
-                           m->offset);
-
-                /* If we reach this point, it means we have obtained a depth and
-                 * offset match, which indicates that we have a FAILURE if the
-                 * content is negated, and SUCCESS if the content is not negated */
-                if (co->negated == 1)
-                    SCReturnInt(0);
-                else
-                    SCReturnInt(1);
-            } else {
-                /* We have success so far with offset, but a failure with
-                 * depth.  We can return a match at the bottom of this function
-                 * for negated_content, provided offset is 0.  If offset
-                 * isn't 0 for negated_content, we have a failure and we return
-                 * a no match here.  If the content is not negated, we have a no
-                 * match, which we return at the end of this function. */
-                if (co->offset && co->negated == 1)
-                    SCReturnInt(0);
-            }
-        } else {
-            /* If offset fails, and if the content is negated, we check if depth
-             * succeeds.  If it succeeds, we have a no match for negated content.
-             * Else we have a success for negated content.  If the content is
-             * not negated, we go down till the end and return a no match. */
-            if (co->negated == 1) {
-                if (co->offset != 0) {
-                    SCReturnInt(1);
-                } else if (co->depth && (m->offset+co->content_len) <= co->depth) {
-                    SCLogDebug("depth %" PRIu32 ", offset %" PRIu32 ", m->offset %" PRIu32 ", "
-                            "return 0", co->depth, co->offset, m->offset);
-                    SCReturnInt(0);
-                }
-            }
-        }
-    }
-    SCLogDebug("depth %" PRIu32 ", offset %" PRIu32 ", m->offset %" PRIu32 ", "
-               "return 0 (or 1 if negated)", co->depth, co->offset, m->offset);
-
-    /* If we reach this point, we have a match for negated content and no match
-     * otherwise */
-    if (co->negated == 1)
-        SCReturnInt(1);
-    else
-        SCReturnInt(0);
-}
-
 /**
  * \brief test the within, distance, offset and depth of a match
  *
diff --git a/src/detect-content.h b/src/detect-content.h
index 63f8208..8efa3a6 100644
--- a/src/detect-content.h
+++ b/src/detect-content.h
@@ -84,4 +84,63 @@ int DetectContentPropagateModifiers(SigMatch *);
 
 void DetectContentFree(void *);
 
+/** ------ inline functions ------ */
+
+static inline int
+TestOffsetDepth(MpmMatch *m, DetectContentData *co, uint16_t pktoff) {
+    SCEnter();
+
+    if (m->offset >= pktoff) {
+        if (co->offset == 0 || (m->offset >= co->offset)) {
+            if (co->depth == 0 || ((m->offset + co->content_len) <= co->depth)) {
+                SCLogDebug("depth %" PRIu32 ", offset %" PRIu32 ", m->offset "
+                           "%" PRIu32 ", return 1", co->depth, co->offset,
+                           m->offset);
+
+                /* If we reach this point, it means we have obtained a depth and
+                 * offset match, which indicates that we have a FAILURE if the
+                 * content is negated, and SUCCESS if the content is not negated */
+                if (co->negated == 1)
+                    SCReturnInt(0);
+                else
+                    SCReturnInt(1);
+            } else {
+                /* We have success so far with offset, but a failure with
+                 * depth.  We can return a match at the bottom of this function
+                 * for negated_content, provided offset is 0.  If offset
+                 * isn't 0 for negated_content, we have a failure and we return
+                 * a no match here.  If the content is not negated, we have a no
+                 * match, which we return at the end of this function. */
+                if (co->offset && co->negated == 1)
+                    SCReturnInt(0);
+            }
+        } else {
+            /* If offset fails, and if the content is negated, we check if depth
+             * succeeds.  If it succeeds, we have a no match for negated content.
+             * Else we have a success for negated content.  If the content is
+             * not negated, we go down till the end and return a no match. */
+            if (co->negated == 1) {
+                if (co->offset != 0) {
+                    SCReturnInt(1);
+                } else if (co->depth && (m->offset+co->content_len) <= co->depth) {
+                    SCLogDebug("depth %" PRIu32 ", offset %" PRIu32 ", m->offset %" PRIu32 ", "
+                            "return 0", co->depth, co->offset, m->offset);
+                    SCReturnInt(0);
+                }
+            }
+        }
+    }
+    SCLogDebug("depth %" PRIu32 ", offset %" PRIu32 ", m->offset %" PRIu32 ", "
+               "return 0 (or 1 if negated)", co->depth, co->offset, m->offset);
+
+    /* If we reach this point, we have a match for negated content and no match
+     * otherwise */
+    if (co->negated == 1)
+        SCReturnInt(1);
+    else
+        SCReturnInt(0);
+}
+
+
+
 #endif /* __DETECT_CONTENT_H__ */
diff --git a/src/detect-dce-iface.c b/src/detect-dce-iface.c
index 76b6c00..9255a38 100644
--- a/src/detect-dce-iface.c
+++ b/src/detect-dce-iface.c
@@ -32,44 +32,6 @@ int DetectDceIfaceSetup(DetectEngineCtx *, Signature *s, SigMatch *m, char *arg)
 void DetectDceIfaceFree(void *);
 
 /**
- * \brief Registers the keyword handlers for the "dce_iface" keyword.
- */
-void DetectDceIfaceRegister(void)
-{
-    const char *eb;
-    int eo;
-    int opts = 0;
-
-    sigmatch_table[DETECT_DCE_IFACE].name = "dce_iface";
-    sigmatch_table[DETECT_DCE_IFACE].alproto = ALPROTO_DCERPC;
-    sigmatch_table[DETECT_DCE_IFACE].Match = NULL;
-    sigmatch_table[DETECT_DCE_IFACE].AppLayerMatch = DetectDceIfaceMatch;
-    sigmatch_table[DETECT_DCE_IFACE].Setup = DetectDceIfaceSetup;
-    sigmatch_table[DETECT_DCE_IFACE].Free  = DetectDceIfaceFree;
-    sigmatch_table[DETECT_DCE_IFACE].RegisterTests = DetectDceIfaceRegisterTests;
-
-    parse_regex = pcre_compile(DETECT_DCE_IFACE_PCRE_PARSE_ARGS, opts, &eb,
-                               &eo, NULL);
-    if (parse_regex == NULL) {
-        SCLogDebug("pcre compile of \"%s\" failed at offset %" PRId32 ": %s",
-                   DETECT_DCE_IFACE_PCRE_PARSE_ARGS, eo, eb);
-        goto error;
-    }
-
-    parse_regex_study = pcre_study(parse_regex, 0, &eb);
-    if (eb != NULL) {
-        SCLogDebug("pcre study failed: %s", eb);
-        goto error;
-    }
-
-    return;
-
- error:
-    /* we need to handle error?! */
-    return;
-}
-
-/**
  * \internal
  * \brief Parses the argument sent along with the "dce_iface" keyword.
  *
@@ -78,7 +40,7 @@ void DetectDceIfaceRegister(void)
  * \retval did Pointer to a DetectDceIfaceData instance that holds the data
  *             from the parsed arg.
  */
-static inline DetectDceIfaceData *DetectDceIfaceArgParse(const char *arg)
+static DetectDceIfaceData *DetectDceIfaceArgParse(const char *arg)
 {
     DetectDceIfaceData *did = NULL;
 #define MAX_SUBSTRINGS 30
@@ -204,31 +166,43 @@ static inline DetectDceIfaceData *DetectDceIfaceArgParse(const char *arg)
     return NULL;
 }
 
+
 /**
- * \internal
- * \brief Internal function that compares the dce interface version for this
- *        flow, to the signature's interface version specified using the
- *        dce_iface keyword.
- *
- * \param version  The dce interface version for this flow.
- * \param dce_data Pointer to the Signature's dce_iface keyword
- *                 state(DetectDceIfaceData *).
+ * \brief Registers the keyword handlers for the "dce_iface" keyword.
  */
-static inline int DetectDceIfaceMatchIfaceVersion(uint16_t version,
-                                                  DetectDceIfaceData *dce_data)
+void DetectDceIfaceRegister(void)
 {
-    switch (dce_data->op) {
-        case DETECT_DCE_IFACE_OP_LT:
-            return (version < dce_data->version);
-        case DETECT_DCE_IFACE_OP_GT:
-            return (version > dce_data->version);
-        case DETECT_DCE_IFACE_OP_EQ:
-            return (version == dce_data->version);
-        case DETECT_DCE_IFACE_OP_NE:
-            return (version != dce_data->version);
-        default:
-            return 1;
+    const char *eb;
+    int eo;
+    int opts = 0;
+
+    sigmatch_table[DETECT_DCE_IFACE].name = "dce_iface";
+    sigmatch_table[DETECT_DCE_IFACE].alproto = ALPROTO_DCERPC;
+    sigmatch_table[DETECT_DCE_IFACE].Match = NULL;
+    sigmatch_table[DETECT_DCE_IFACE].AppLayerMatch = DetectDceIfaceMatch;
+    sigmatch_table[DETECT_DCE_IFACE].Setup = DetectDceIfaceSetup;
+    sigmatch_table[DETECT_DCE_IFACE].Free  = DetectDceIfaceFree;
+    sigmatch_table[DETECT_DCE_IFACE].RegisterTests = DetectDceIfaceRegisterTests;
+
+    parse_regex = pcre_compile(DETECT_DCE_IFACE_PCRE_PARSE_ARGS, opts, &eb,
+                               &eo, NULL);
+    if (parse_regex == NULL) {
+        SCLogDebug("pcre compile of \"%s\" failed at offset %" PRId32 ": %s",
+                   DETECT_DCE_IFACE_PCRE_PARSE_ARGS, eo, eb);
+        goto error;
+    }
+
+    parse_regex_study = pcre_study(parse_regex, 0, &eb);
+    if (eb != NULL) {
+        SCLogDebug("pcre study failed: %s", eb);
+        goto error;
     }
+
+    return;
+
+ error:
+    /* we need to handle error?! */
+    return;
 }
 
 /**
diff --git a/src/detect-dce-iface.h b/src/detect-dce-iface.h
index 91f8836..cec67cd 100644
--- a/src/detect-dce-iface.h
+++ b/src/detect-dce-iface.h
@@ -23,4 +23,34 @@ typedef struct DetectDceIfaceData_ {
 void DetectDceIfaceRegister(void);
 void DetectDceIfaceRegisterTests(void);
 
+/** ------ inline functions ------ */
+
+/**
+ * \internal
+ * \brief Internal function that compares the dce interface version for this
+ *        flow, to the signature's interface version specified using the
+ *        dce_iface keyword.
+ *
+ * \param version  The dce interface version for this flow.
+ * \param dce_data Pointer to the Signature's dce_iface keyword
+ *                 state(DetectDceIfaceData *).
+ */
+static inline int DetectDceIfaceMatchIfaceVersion(uint16_t version,
+                                                  DetectDceIfaceData *dce_data)
+{
+    switch (dce_data->op) {
+        case DETECT_DCE_IFACE_OP_LT:
+            return (version < dce_data->version);
+        case DETECT_DCE_IFACE_OP_GT:
+            return (version > dce_data->version);
+        case DETECT_DCE_IFACE_OP_EQ:
+            return (version == dce_data->version);
+        case DETECT_DCE_IFACE_OP_NE:
+            return (version != dce_data->version);
+        default:
+            return 1;
+    }
+}
+
+
 #endif /* __DETECT_DCE_IFACE_H__ */
diff --git a/src/detect-dce-opnum.c b/src/detect-dce-opnum.c
index 2d13ce2..d620e3c 100644
--- a/src/detect-dce-opnum.c
+++ b/src/detect-dce-opnum.c
@@ -32,64 +32,6 @@ int DetectDceOpnumSetup(DetectEngineCtx *, Signature *s, SigMatch *m, char *arg)
 void DetectDceOpnumFree(void *);
 
 /**
- * \brief Registers the keyword handlers for the "dce_opnum" keyword.
- */
-void DetectDceOpnumRegister(void)
-{
-    const char *eb;
-    int eo;
-    int opts = 0;
-
-    sigmatch_table[DETECT_DCE_OPNUM].name = "dce_opnum";
-    sigmatch_table[DETECT_DCE_OPNUM].alproto = ALPROTO_DCERPC;
-    sigmatch_table[DETECT_DCE_OPNUM].Match = NULL;
-    sigmatch_table[DETECT_DCE_OPNUM].AppLayerMatch = DetectDceOpnumMatch;
-    sigmatch_table[DETECT_DCE_OPNUM].Setup = DetectDceOpnumSetup;
-    sigmatch_table[DETECT_DCE_OPNUM].Free  = DetectDceOpnumFree;
-    sigmatch_table[DETECT_DCE_OPNUM].RegisterTests = DetectDceOpnumRegisterTests;
-
-    parse_regex = pcre_compile(DETECT_DCE_OPNUM_PCRE_PARSE_ARGS, opts, &eb,
-                               &eo, NULL);
-    if (parse_regex == NULL) {
-        SCLogError(SC_ERR_PCRE_COMPILE, "pcre compile of \"%s\" failed at offset %" PRId32 ": %s",
-                   DETECT_DCE_OPNUM_PCRE_PARSE_ARGS, eo, eb);
-        goto error;
-    }
-
-    parse_regex_study = pcre_study(parse_regex, 0, &eb);
-    if (eb != NULL) {
-        SCLogError(SC_ERR_PCRE_STUDY, "pcre study failed: %s", eb);
-        goto error;
-    }
-
-    return;
-
- error:
-    /* we need to handle error?! */
-    return;
-}
-
-/**
- * \internal
- * \brief Creates and returns a new instance of DetectDceOpnumRange.
- *
- * \retval dor Pointer to the new instance DetectDceOpnumRange.
- */
-static inline DetectDceOpnumRange *DetectDceOpnumAllocDetectDceOpnumRange(void)
-{
-    DetectDceOpnumRange *dor = NULL;
-
-    if ( (dor = SCMalloc(sizeof(DetectDceOpnumRange))) == NULL) {
-        SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory");
-        exit(EXIT_FAILURE);
-    }
-    memset(dor, 0, sizeof(DetectDceOpnumRange));
-    dor->range1 = dor->range2 = DCE_OPNUM_RANGE_UNINITIALIZED;
-
-    return dor;
-}
-
-/**
  * \internal
  * \brief Parses the argument sent along with the "dce_opnum" keyword.
  *
@@ -98,7 +40,7 @@ static inline DetectDceOpnumRange *DetectDceOpnumAllocDetectDceOpnumRange(void)
  * \retval did Pointer to a DetectDceIfaceData instance that holds the data
  *             from the parsed arg.
  */
-static inline DetectDceOpnumData *DetectDceOpnumArgParse(const char *arg)
+static DetectDceOpnumData *DetectDceOpnumArgParse(const char *arg)
 {
     DetectDceOpnumData *dod = NULL;
 
@@ -219,6 +161,44 @@ static inline DetectDceOpnumData *DetectDceOpnumArgParse(const char *arg)
 }
 
 /**
+ * \brief Registers the keyword handlers for the "dce_opnum" keyword.
+ */
+void DetectDceOpnumRegister(void)
+{
+    const char *eb;
+    int eo;
+    int opts = 0;
+
+    sigmatch_table[DETECT_DCE_OPNUM].name = "dce_opnum";
+    sigmatch_table[DETECT_DCE_OPNUM].alproto = ALPROTO_DCERPC;
+    sigmatch_table[DETECT_DCE_OPNUM].Match = NULL;
+    sigmatch_table[DETECT_DCE_OPNUM].AppLayerMatch = DetectDceOpnumMatch;
+    sigmatch_table[DETECT_DCE_OPNUM].Setup = DetectDceOpnumSetup;
+    sigmatch_table[DETECT_DCE_OPNUM].Free  = DetectDceOpnumFree;
+    sigmatch_table[DETECT_DCE_OPNUM].RegisterTests = DetectDceOpnumRegisterTests;
+
+    parse_regex = pcre_compile(DETECT_DCE_OPNUM_PCRE_PARSE_ARGS, opts, &eb,
+                               &eo, NULL);
+    if (parse_regex == NULL) {
+        SCLogError(SC_ERR_PCRE_COMPILE, "pcre compile of \"%s\" failed at offset %" PRId32 ": %s",
+                   DETECT_DCE_OPNUM_PCRE_PARSE_ARGS, eo, eb);
+        goto error;
+    }
+
+    parse_regex_study = pcre_study(parse_regex, 0, &eb);
+    if (eb != NULL) {
+        SCLogError(SC_ERR_PCRE_STUDY, "pcre study failed: %s", eb);
+        goto error;
+    }
+
+    return;
+
+ error:
+    /* we need to handle error?! */
+    return;
+}
+
+/**
  * \brief App layer match function for the "dce_opnum" keyword.
  *
  * \param t       Pointer to the ThreadVars instance.
diff --git a/src/detect-dce-opnum.h b/src/detect-dce-opnum.h
index 4ae1e73..504f47d 100644
--- a/src/detect-dce-opnum.h
+++ b/src/detect-dce-opnum.h
@@ -21,4 +21,28 @@ typedef struct DetectDceOpnumData_ {
 void DetectDceOpnumRegister(void);
 void DetectDceOpnumRegisterTests(void);
 
+/** ------ inline functions ------ */
+
+/**
+ * \internal
+ * \brief Creates and returns a new instance of DetectDceOpnumRange.
+ *
+ * \retval dor Pointer to the new instance DetectDceOpnumRange.
+ */
+static inline DetectDceOpnumRange *DetectDceOpnumAllocDetectDceOpnumRange(void)
+{
+    DetectDceOpnumRange *dor = NULL;
+
+    if ( (dor = SCMalloc(sizeof(DetectDceOpnumRange))) == NULL) {
+        SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory");
+        exit(EXIT_FAILURE);
+    }
+    memset(dor, 0, sizeof(DetectDceOpnumRange));
+    dor->range1 = dor->range2 = DCE_OPNUM_RANGE_UNINITIALIZED;
+
+    return dor;
+}
+
+
+
 #endif /* __DETECT_DCE_OPNUM_H__ */
diff --git a/src/detect-engine-address.h b/src/detect-engine-address.h
index 70f3b54..e8e945c 100644
--- a/src/detect-engine-address.h
+++ b/src/detect-engine-address.h
@@ -4,10 +4,11 @@
  * \author Victor Julien
  */
 
-
 #ifndef __DETECT_ADDRESS_H__
 #define __DETECT_ADDRESS_H__
 
+#include "detect.h"
+
 /* prototypes */
 void DetectAddressRegister (void);
 void DetectAddressPrintMemory(void);
diff --git a/src/detect-engine-port.h b/src/detect-engine-port.h
index cbf3908..0aa93fe 100644
--- a/src/detect-engine-port.h
+++ b/src/detect-engine-port.h
@@ -1,6 +1,10 @@
 #ifndef __DETECT_PORT_H__
 #define __DETECT_PORT_H__
 
+/** \brief Port structure for detection engine */
+
+#include "detect.h"
+
 /* prototypes */
 void DetectPortRegister (void);
 
diff --git a/src/detect-engine-sigorder.c b/src/detect-engine-sigorder.c
index 48ca5e9..54b18fb 100644
--- a/src/detect-engine-sigorder.c
+++ b/src/detect-engine-sigorder.c
@@ -16,15 +16,6 @@
 #include "util-unittest.h"
 #include "util-debug.h"
 
-#define DETECT_FLOWVAR_NOT_USED   1
-#define DETECT_FLOWVAR_TYPE_READ  2
-#define DETECT_FLOWVAR_TYPE_SET   3
-
-#define DETECT_PKTVAR_NOT_USED   1
-#define DETECT_PKTVAR_TYPE_READ  2
-#define DETECT_PKTVAR_TYPE_SET   3
-
-
 /**
  * \brief Registers a keyword-based, signature ordering function
  *
@@ -72,153 +63,6 @@ static void SCSigRegisterSignatureOrderingFunc(DetectEngineCtx *de_ctx,
 }
 
 /**
- * \brief Returns the flowbit type set for this signature.  If more than one
- *        flowbit has been set for the same rule, we return the flowbit type of
- *        the maximum priority/value, where priority/value is maximum for the
- *        ones that set the value and the lowest for ones that read the value.
- *        If no flowbit has been set for the rule, we return 0, which indicates
- *        the least value amongst flowbit types.
- *
- * \param sig Pointer to the Signature from which the flowbit value has to be
- *            returned.
- *
- * \retval flowbits The flowbits type for this signature if it is set; if it is
- *                  not set, return 0
- */
-static inline int SCSigGetFlowbitsType(Signature *sig)
-{
-    SigMatch *sm = sig->match;
-    DetectFlowbitsData *fb = NULL;
-    int flowbits = 0;
-
-    while (sm != NULL) {
-        if (sm->type == DETECT_FLOWBITS) {
-            fb = (DetectFlowbitsData *)sm->ctx;
-            if (flowbits < fb->cmd)
-                flowbits = fb->cmd;
-        }
-
-        sm = sm->next;
-    }
-
-    return flowbits;
-}
-
-/**
- * \brief Returns whether the flowvar set for this rule, sets the flowvar or
- *        reads the flowvar.  If the rule sets the flowvar the function returns
- *        DETECT_FLOWVAR_TYPE_SET(3), if it reads the flowvar the function
- *        returns DETECT_FLOWVAR_TYPE_READ(2), and if flowvar is not used in this
- *        rule the function returns DETECT_FLOWVAR_NOT_USED(1)
- *
- * \param sig Pointer to the Signature from which the flowvar type has to be
- *            returned.
- *
- * \retval type DETECT_FLOWVAR_TYPE_SET(3) if the rule sets the flowvar,
- *              DETECT_FLOWVAR_TYPE_READ(2) if it reads, and
- *              DETECT_FLOWVAR_NOT_USED(1) if flowvar is not used.
- */
-static inline int SCSigGetFlowvarType(Signature *sig)
-{
-    SigMatch *sm = sig->match;
-    DetectPcreData *pd = NULL;
-    int type = DETECT_FLOWVAR_NOT_USED;
-
-    while (sm != NULL) {
-        pd = (DetectPcreData *)sm->ctx;
-        if (sm->type == DETECT_PCRE && pd->flags & DETECT_PCRE_CAPTURE_FLOW) {
-            type = DETECT_FLOWVAR_TYPE_SET;
-            return type;
-        }
-
-        if (sm->type == DETECT_FLOWVAR)
-            type = DETECT_FLOWVAR_TYPE_READ;
-
-        sm = sm->next;
-    }
-
-    return type;
-}
-
-/**
- * \brief Returns whether the pktvar set for this rule, sets the flowvar or
- *        reads the pktvar.  If the rule sets the pktvar the function returns
- *        DETECT_PKTVAR_TYPE_SET(3), if it reads the pktvar the function
- *        returns DETECT_PKTVAR_TYPE_READ(2), and if pktvar is not used in this
- *        rule the function returns DETECT_PKTVAR_NOT_USED(1)
- *
- * \param sig Pointer to the Signature from which the pktvar type has to be
- *            returned.
- *
- * \retval type DETECT_PKTVAR_TYPE_SET(3) if the rule sets the flowvar,
- *              DETECT_PKTVAR_TYPE_READ(2) if it reads, and
- *              DETECT_PKTVAR_NOT_USED(1) if pktvar is not used.
- */
-static inline int SCSigGetPktvarType(Signature *sig)
-{
-    SigMatch *sm = sig->match;
-    DetectPcreData *pd = NULL;
-    int type = DETECT_PKTVAR_NOT_USED;
-
-    while (sm != NULL) {
-        pd = (DetectPcreData *)sm->ctx;
-        if (sm->type == DETECT_PCRE && pd->flags & DETECT_PCRE_CAPTURE_PKT) {
-            type = DETECT_PKTVAR_TYPE_SET;
-            return type;
-        }
-
-        if (sm->type == DETECT_PKTVAR)
-            type = DETECT_PKTVAR_TYPE_READ;
-
-        sm = sm->next;
-    }
-
-    return type;
-}
-
-/**
- * \brief Processes the flowbits data for this signature and caches it for
- *        future use.  This is needed to optimize the sig_ordering module.
- *
- * \param sw The sigwrapper/signature for which the flowbits data has to be
- *           cached
- */
-static inline void SCSigProcessUserDataForFlowbits(SCSigSignatureWrapper *sw)
-{
-    *((int *)(sw->user[SC_RADIX_USER_DATA_FLOWBITS])) = SCSigGetFlowbitsType(sw->sig);
-
-    return;
-}
-
-/**
- * \brief Processes the flowvar data for this signature and caches it for
- *        future use.  This is needed to optimize the sig_ordering module.
- *
- * \param sw The sigwrapper/signature for which the flowvar data has to be
- *           cached
- */
-static inline void SCSigProcessUserDataForFlowvar(SCSigSignatureWrapper *sw)
-{
-    *((int *)(sw->user[SC_RADIX_USER_DATA_FLOWVAR])) = SCSigGetFlowvarType(sw->sig);
-
-    return;
-}
-
-/**
- * \brief Processes the pktvar data for this signature and caches it for
- *        future use.  This is needed to optimize the sig_ordering module.
- *
- * \param sw The sigwrapper/signature for which the pktvar data has to be
- *           cached
- */
-static inline void SCSigProcessUserDataForPktvar(SCSigSignatureWrapper *sw)
-{
-    *((int *)(sw->user[SC_RADIX_USER_DATA_PKTVAR])) = SCSigGetPktvarType(sw->sig);
-
-    return;
-}
-
-/**
  * \brief Orders an incoming Signature based on its action
  *
  * \param de_ctx Pointer to the detection engine context from which the
@@ -728,49 +572,6 @@ static void SCSigOrderByPriority(DetectEngineCtx *de_ctx,
 }
 
 /**
- * \brief Creates a Wrapper around the Signature
- *
- * \param Pointer to the Signature to be wrapped
- *
- * \retval sw Pointer to the wrapper that holds the signature
- */
-static inline SCSigSignatureWrapper *SCSigAllocSignatureWrapper(Signature *sig)
-{
-    SCSigSignatureWrapper *sw = NULL;
-    int i = 0;
-
-    if ( (sw = SCMalloc(sizeof(SCSigSignatureWrapper))) == NULL) {
-        printf("Error allocating memory\n");
-        exit(EXIT_FAILURE);
-    }
-    memset(sw, 0, sizeof(SCSigSignatureWrapper));
-
-    sw->sig = sig;
-
-    if ( (sw->user = SCMalloc(SC_RADIX_USER_DATA_MAX * sizeof(int *))) == NULL) {
-        printf("Error allocating memory\n");
-        exit(EXIT_FAILURE);
-    }
-    memset(sw->user, 0, SC_RADIX_USER_DATA_MAX * sizeof(int *));
-
-    for (i = 0; i < SC_RADIX_USER_DATA_MAX; i++) {
-        if ( (sw->user[i] = SCMalloc(sizeof(int))) == NULL) {
-            printf("Error allocating memory\n");
-            exit(EXIT_FAILURE);
-        }
-        memset(sw->user[i], 0, sizeof(int));
-    }
-
-    /* Process data from the signature into a cache for further use by the
-     * sig_ordering module */
-    SCSigProcessUserDataForFlowbits(sw);
-    SCSigProcessUserDataForFlowvar(sw);
-    SCSigProcessUserDataForPktvar(sw);
-
-    return sw;
-}
-
-/**
  * \brief Orders the signatures
  *
  * \param de_ctx Pointer to the Detection Engine Context that holds the
diff --git a/src/detect-engine-sigorder.h b/src/detect-engine-sigorder.h
index c79e040..7611d7f 100644
--- a/src/detect-engine-sigorder.h
+++ b/src/detect-engine-sigorder.h
@@ -5,6 +5,29 @@
 #ifndef __DETECT_ENGINE_SIGORDER_H__
 #define __DETECT_ENGINE_SIGORDER_H__
 
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <pcre.h>
+
+#include "suricata-common.h"
+#include "detect.h"
+#include "detect-flowbits.h"
+#include "detect-engine-sigorder.h"
+#include "detect-pcre.h"
+
+#include "util-unittest.h"
+#include "util-debug.h"
+
+#define DETECT_FLOWVAR_NOT_USED   1
+#define DETECT_FLOWVAR_TYPE_READ  2
+#define DETECT_FLOWVAR_TYPE_SET   3
+
+#define DETECT_PKTVAR_NOT_USED   1
+#define DETECT_PKTVAR_TYPE_READ  2
+#define DETECT_PKTVAR_TYPE_SET   3
+
+
 /**
  * \brief Different kinds of helper data that can be used by the signature
  *        ordering module.  Used by the "user" field in SCSigSignatureWrapper
@@ -56,4 +79,205 @@ void SCSigRegisterSignatureOrderingFuncs(DetectEngineCtx *);
 void SCSigRegisterSignatureOrderingTests(void);
 void SCSigSignatureOrderingModuleCleanup(DetectEngineCtx *);
 
+/** ------ inline functions ------ */
+static inline SCSigSignatureWrapper *SCSigAllocSignatureWrapper(Signature *);
+static inline int SCSigGetFlowbitsType(Signature *);
+static inline int SCSigGetFlowvarType(Signature *);
+static inline int SCSigGetPktvarType(Signature *);
+static inline void SCSigProcessUserDataForFlowbits(SCSigSignatureWrapper *);
+static inline void SCSigProcessUserDataForFlowvar(SCSigSignatureWrapper *);
+static inline void SCSigProcessUserDataForPktvar(SCSigSignatureWrapper *);
+
+/**
+ * \brief Creates a Wrapper around the Signature
+ *
+ * \param Pointer to the Signature to be wrapped
+ *
+ * \retval sw Pointer to the wrapper that holds the signature
+ */
+static inline SCSigSignatureWrapper *SCSigAllocSignatureWrapper(Signature *sig)
+{
+    SCSigSignatureWrapper *sw = NULL;
+    int i = 0;
+
+    if ( (sw = SCMalloc(sizeof(SCSigSignatureWrapper))) == NULL) {
+        printf("Error allocating memory\n");
+        exit(EXIT_FAILURE);
+    }
+    memset(sw, 0, sizeof(SCSigSignatureWrapper));
+
+    sw->sig = sig;
+
+    if ( (sw->user = SCMalloc(SC_RADIX_USER_DATA_MAX * sizeof(int *))) == NULL) {
+        printf("Error allocating memory\n");
+        exit(EXIT_FAILURE);
+    }
+    memset(sw->user, 0, SC_RADIX_USER_DATA_MAX * sizeof(int *));
+
+    for (i = 0; i < SC_RADIX_USER_DATA_MAX; i++) {
+        if ( (sw->user[i] = SCMalloc(sizeof(int))) == NULL) {
+            printf("Error allocating memory\n");
+            exit(EXIT_FAILURE);
+        }
+        memset(sw->user[i], 0, sizeof(int));
+    }
+
+    /* Process data from the signature into a cache for further use by the
+     * sig_ordering module */
+    SCSigProcessUserDataForFlowbits(sw);
+    SCSigProcessUserDataForFlowvar(sw);
+    SCSigProcessUserDataForPktvar(sw);
+
+    return sw;
+}
+
+/**
+ * \brief Returns the flowbit type set for this signature.  If more than one
+ *        flowbit has been set for the same rule, we return the flowbit type of
+ *        the maximum priority/value, where priority/value is maximum for the
+ *        ones that set the value and the lowest for ones that read the value.
+ *        If no flowbit has been set for the rule, we return 0, which indicates
+ *        the least value amongst flowbit types.
+ *
+ * \param sig Pointer to the Signature from which the flowbit value has to be
+ *            returned.
+ *
+ * \retval flowbits The flowbits type for this signature if it is set; if it is
+ *                  not set, return 0
+ */
+static inline int SCSigGetFlowbitsType(Signature *sig)
+{
+    SigMatch *sm = sig->match;
+    DetectFlowbitsData *fb = NULL;
+    int flowbits = 0;
+
+    while (sm != NULL) {
+        if (sm->type == DETECT_FLOWBITS) {
+            fb = (DetectFlowbitsData *)sm->ctx;
+            if (flowbits < fb->cmd)
+                flowbits = fb->cmd;
+        }
+
+        sm = sm->next;
+    }
+
+    return flowbits;
+}
+
+/**
+ * \brief Returns whether the flowvar set for this rule, sets the flowvar or
+ *        reads the flowvar.  If the rule sets the flowvar the function returns
+ *        DETECT_FLOWVAR_TYPE_SET(3), if it reads the flowvar the function
+ *        returns DETECT_FLOWVAR_TYPE_READ(2), and if flowvar is not used in this
+ *        rule the function returns DETECT_FLOWVAR_NOT_USED(1)
+ *
+ * \param sig Pointer to the Signature from which the flowvar type has to be
+ *            returned.
+ *
+ * \retval type DETECT_FLOWVAR_TYPE_SET(3) if the rule sets the flowvar,
+ *              DETECT_FLOWVAR_TYPE_READ(2) if it reads, and
+ *              DETECT_FLOWVAR_NOT_USED(1) if flowvar is not used.
+ */
+static inline int SCSigGetFlowvarType(Signature *sig)
+{
+    SigMatch *sm = sig->match;
+    DetectPcreData *pd = NULL;
+    int type = DETECT_FLOWVAR_NOT_USED;
+
+    while (sm != NULL) {
+        pd = (DetectPcreData *)sm->ctx;
+        if (sm->type == DETECT_PCRE && pd->flags & DETECT_PCRE_CAPTURE_FLOW) {
+            type = DETECT_FLOWVAR_TYPE_SET;
+            return type;
+        }
+
+        if (sm->type == DETECT_FLOWVAR)
+            type = DETECT_FLOWVAR_TYPE_READ;
+
+        sm = sm->next;
+    }
+
+    return type;
+}
+
+/**
+ * \brief Returns whether the pktvar set for this rule, sets the flowvar or
+ *        reads the pktvar.  If the rule sets the pktvar the function returns
+ *        DETECT_PKTVAR_TYPE_SET(3), if it reads the pktvar the function
+ *        returns DETECT_PKTVAR_TYPE_READ(2), and if pktvar is not used in this
+ *        rule the function returns DETECT_PKTVAR_NOT_USED(1)
+ *
+ * \param sig Pointer to the Signature from which the pktvar type has to be
+ *            returned.
+ *
+ * \retval type DETECT_PKTVAR_TYPE_SET(3) if the rule sets the flowvar,
+ *              DETECT_PKTVAR_TYPE_READ(2) if it reads, and
+ *              DETECT_PKTVAR_NOT_USED(1) if pktvar is not used.
+ */
+static inline int SCSigGetPktvarType(Signature *sig)
+{
+    SigMatch *sm = sig->match;
+    DetectPcreData *pd = NULL;
+    int type = DETECT_PKTVAR_NOT_USED;
+
+    while (sm != NULL) {
+        pd = (DetectPcreData *)sm->ctx;
+        if (sm->type == DETECT_PCRE && pd->flags & DETECT_PCRE_CAPTURE_PKT) {
+            type = DETECT_PKTVAR_TYPE_SET;
+            return type;
+        }
+
+        if (sm->type == DETECT_PKTVAR)
+            type = DETECT_PKTVAR_TYPE_READ;
+
+        sm = sm->next;
+    }
+
+    return type;
+}
+
+/**
+ * \brief Processes the flowbits data for this signature and caches it for
+ *        future use.  This is needed to optimize the sig_ordering module.
+ *
+ * \param sw The sigwrapper/signature for which the flowbits data has to be
+ *           cached
+ */
+static inline void SCSigProcessUserDataForFlowbits(SCSigSignatureWrapper *sw)
+{
+    *((int *)(sw->user[SC_RADIX_USER_DATA_FLOWBITS])) = SCSigGetFlowbitsType(sw->sig);
+
+    return;
+}
+
+/**
+ * \brief Processes the flowvar data for this signature and caches it for
+ *        future use.  This is needed to optimize the sig_ordering module.
+ *
+ * \param sw The sigwrapper/signature for which the flowvar data has to be
+ *           cached
+ */
+static inline void SCSigProcessUserDataForFlowvar(SCSigSignatureWrapper *sw)
+{
+    *((int *)(sw->user[SC_RADIX_USER_DATA_FLOWVAR])) = SCSigGetFlowvarType(sw->sig);
+
+    return;
+}
+
+/**
+ * \brief Processes the pktvar data for this signature and caches it for
+ *        future use.  This is needed to optimize the sig_ordering module.
+ *
+ * \param sw The sigwrapper/signature for which the pktvar data has to be
+ *           cached
+ */
+static inline void SCSigProcessUserDataForPktvar(SCSigSignatureWrapper *sw)
+{
+    *((int *)(sw->user[SC_RADIX_USER_DATA_PKTVAR])) = SCSigGetPktvarType(sw->sig);
+
+    return;
+}
+
+
+
 #endif /* __DETECT_ENGINE_SIGORDER_H__ */
diff --git a/src/detect-fast-pattern.c b/src/detect-fast-pattern.c
index 86cca74..9201710 100644
--- a/src/detect-fast-pattern.c
+++ b/src/detect-fast-pattern.c
@@ -78,11 +78,6 @@ int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, SigMatch *m,
 
 #ifdef UNITTESTS
 
-inline SigGroupHead *SigMatchSignaturesGetSgh(ThreadVars *,
-                                              DetectEngineCtx *,
-                                              DetectEngineThreadCtx *,
-                                              Packet *);
-
 /**
  * \test Checks if a fast_pattern is registered in a Signature
  */
diff --git a/src/detect-fast-pattern.h b/src/detect-fast-pattern.h
index bc12498..cece5e5 100644
--- a/src/detect-fast-pattern.h
+++ b/src/detect-fast-pattern.h
@@ -6,6 +6,5 @@
 #define __DETECT_FAST_PATTERN_H__
 
 void DetectFastPatternRegister(void);
-
 #endif /* __DETECT_FAST_PATTERN_H__ */
 
diff --git a/src/detect-stream_size.c b/src/detect-stream_size.c
index b73526b..f9b4946 100644
--- a/src/detect-stream_size.c
+++ b/src/detect-stream_size.c
@@ -63,50 +63,6 @@ error:
 }
 
 /**
- * \brief Function to comapre the stream size against defined size in the user
- *  options.
- *
- *  \param  diff    The stream size of server or client stream.
- *  \param  stream_size User defined stream size
- *  \param  mode    The mode defined by user.
- *
- *  \retval 1 on success and 0 on failure.
- */
-
-static inline int DetectStreamSizeCompare (uint32_t diff, uint32_t stream_size, uint8_t mode) {
-
-    int ret = 0;
-    switch (mode) {
-        case DETECTSSIZE_LT:
-            if (diff < stream_size)
-                ret = 1;
-            break;
-        case DETECTSSIZE_LEQ:
-            if (diff <= stream_size)
-                ret = 1;
-            break;
-        case DETECTSSIZE_EQ:
-            if (diff == stream_size)
-                ret = 1;
-            break;
-        case DETECTSSIZE_NEQ:
-            if (diff != stream_size)
-                ret = 1;
-            break;
-        case DETECTSSIZE_GEQ:
-            if (diff >= stream_size)
-                ret = 1;
-            break;
-        case DETECTSSIZE_GT:
-            if (diff > stream_size)
-                ret = 1;
-            break;
-    }
-
-    return ret;
-}
-
-/**
  * \brief This function is used to match Stream size rule option on a packet with those passed via stream_size:
  *
  * \param t pointer to thread vars
diff --git a/src/detect-stream_size.h b/src/detect-stream_size.h
index 61e67a9..1201830 100644
--- a/src/detect-stream_size.h
+++ b/src/detect-stream_size.h
@@ -28,5 +28,52 @@ typedef struct DetectStreamSizeData_ {
 
 void DetectStreamSizeRegister(void);
 
+/** ------ inline functions ------ */
+
+/**
+ * \brief Function to comapre the stream size against defined size in the user
+ *  options.
+ *
+ *  \param  diff    The stream size of server or client stream.
+ *  \param  stream_size User defined stream size
+ *  \param  mode    The mode defined by user.
+ *
+ *  \retval 1 on success and 0 on failure.
+ */
+
+static inline int DetectStreamSizeCompare (uint32_t diff, uint32_t stream_size, uint8_t mode) {
+
+    int ret = 0;
+    switch (mode) {
+        case DETECTSSIZE_LT:
+            if (diff < stream_size)
+                ret = 1;
+            break;
+        case DETECTSSIZE_LEQ:
+            if (diff <= stream_size)
+                ret = 1;
+            break;
+        case DETECTSSIZE_EQ:
+            if (diff == stream_size)
+                ret = 1;
+            break;
+        case DETECTSSIZE_NEQ:
+            if (diff != stream_size)
+                ret = 1;
+            break;
+        case DETECTSSIZE_GEQ:
+            if (diff >= stream_size)
+                ret = 1;
+            break;
+        case DETECTSSIZE_GT:
+            if (diff > stream_size)
+                ret = 1;
+            break;
+    }
+
+    return ret;
+}
+
+
 #endif	/* _DETECT_STREAM_SIZE_H */
 
diff --git a/src/detect-uricontent.c b/src/detect-uricontent.c
index 89d50e1..ac366e8 100644
--- a/src/detect-uricontent.c
+++ b/src/detect-uricontent.c
@@ -85,135 +85,6 @@ void PktHttpUriFree(Packet *p)
     p->http_uri.cnt = 0;
 }
 
-static inline int TestOffsetDepth(MpmMatch *m, DetectUricontentData *co)
-{
-    if (co->offset == 0 ||
-        (co->offset && ((m->offset+1) - co->uricontent_len) >= co->offset))
-    {
-        if (co->depth == 0 ||
-            (co->depth && (m->offset+1) <= co->depth))
-        {
-            return 1;
-        }
-    }
-
-    return 0;
-}
-
-/* This function is called recursively (if necessary) to be able
- * to determite whether or not a chain of content matches connected
- * with 'within' and 'distance' options fully matches. The reason it
- * was done like this is to make sure we can handle partial matches
- * that turn out to fail being followed by full matches later in the
- * packet. This adds some runtime complexity however. */
-static inline int TestWithinDistanceOffsetDepth(ThreadVars *t,
-                                                DetectEngineThreadCtx *det_ctx,
-                                                MpmMatch *m, SigMatch *nsm)
-{
-    //printf("test_nextsigmatch m:%p, nsm:%p\n", m,nsm);
-    if (nsm == NULL)
-        return 1;
-
-    DetectUricontentData *co = (DetectUricontentData *)nsm->ctx;
-    MpmMatch *nm = det_ctx->mtcu.match[co->id].top;
-
-    for (; nm; nm = nm->next) {
-        SCLogDebug("(nm->offset+1) %" PRIu32 ", (m->offset+1) %" PRIu32 "",
-                    (nm->offset+1), (m->offset+1));
-
-        if ((co->within == 0 || (co->within &&
-           ((nm->offset+1) > (m->offset+1)) &&
-           ((nm->offset+1) - (m->offset+1) <= co->within))))
-        {
-             SCLogDebug("WITHIN (nm->offset+1) %" PRIu32 ", (m->offset+1) "
-                        "%" PRIu32 "", (nm->offset+1), (m->offset+1));
-
-            if (co->distance == 0 || (co->distance &&
-               ((nm->offset+1) > (m->offset+1)) &&
-               ((nm->offset+1) - (m->offset+1) >= co->distance)))
-            {
-                if (TestOffsetDepth(nm, co) == 1) {
-                      SCLogDebug("DISTANCE (nm->offset+1) %" PRIu32 ", "
-                                 "(m->offset+1) %" PRIu32 "", (nm->offset+1),
-                                 (m->offset+1));
-                    return TestWithinDistanceOffsetDepth(t, det_ctx, nm,
-                                                         nsm->next);
-                }
-            }
-        }
-    }
-    return 0;
-}
-
-static inline int DoDetectUricontent(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
-                                     Packet *p, SigMatch *sm,
-                                     DetectUricontentData *co)
-{
-    int ret = 0;
-    char match = 0;
-
-    /* Get the top match, we already know we have one. */
-    MpmMatch *m = det_ctx->mtcu.match[co->id].top;
-
-    /*  if we have within or distance coming up next, check this match
-     *  for distance and/or within and check the rest of this match
-     *  chain as well. */
-    if ((co->flags & DETECT_URICONTENT_WITHIN_NEXT ||
-         co->flags & DETECT_URICONTENT_DISTANCE_NEXT) &&
-         det_ctx->de_checking_distancewithin == 0)
-    {
-        /* indicate to the detection engine the next sigmatch(es)
-         * are part of this match chain */
-        det_ctx->de_checking_distancewithin = 1;
-
-        for (; m != NULL; m = m->next) {
-            /* first check our match for offset and depth */
-            if (TestOffsetDepth(m, co) == 1) {
-                ret = TestWithinDistanceOffsetDepth(t, det_ctx, m, sm->next);
-                if (ret == 1) {
-                    /* update pkt ptrs, content doesn't use this,
-                     * but pcre does */
-                    det_ctx->pkt_ptr = p->payload + m->offset;
-                    det_ctx->pkt_off = m->offset;
-                    match = 1;
-                    break;
-                }
-            }
-        }
-    /* Okay, this is complicated... on the first match of a match chain,
-     * we do the whole match of that chain (a chain here means a number
-     * of consecutive content matches that relate to each other with
-     * 'within and/or 'distance options'). But we still get to the next
-     * sigmatches. We have already inspected this sigmatch, even for
-     * offset and depth. Since the fact that we get there means we have
-     * had a match, we return match here too.
-     */
-    } else if (co->flags & DETECT_URICONTENT_WITHIN ||
-               co->flags & DETECT_URICONTENT_DISTANCE)
-    {
-        det_ctx->de_checking_distancewithin = 0;
-        match = 1;
-    /* Getting here means we are not in checking an within/distance chain.
-     * This means we can just inspect this content match on it's own. So
-     * Let's see if at least one of the matches within the offset and depth
-     * settings. If so, return a match.
-     */
-    } else {
-        for (; m != NULL; m = m->next) {
-            ret = TestOffsetDepth(m,co);
-            if (ret == 1) {
-                /* update pkt ptrs, content doesn't use this,
-                 * but pcre does */
-                det_ctx->pkt_ptr = p->payload + m->offset;
-                det_ctx->pkt_off = m->offset;
-                match = 1;
-                break;
-            }
-        }
-    }
-    return match;
-}
-
 
 /**
  * \brief   Checks if the packet sent as the argument, has a uricontent which
diff --git a/src/detect-uricontent.h b/src/detect-uricontent.h
index 063fd0a..67c117e 100644
--- a/src/detect-uricontent.h
+++ b/src/detect-uricontent.h
@@ -28,5 +28,137 @@ uint32_t DetectUricontentMaxId(DetectEngineCtx *);
 void PktHttpUriFree(Packet *p);
 uint32_t DetectUricontentInspectMpm(ThreadVars *th_v, DetectEngineThreadCtx *det_ctx, void *alstate);
 
+/** ------ inline functions ------ */
+
+static inline int TestOffsetDepthUri(MpmMatch *m, DetectUricontentData *co)
+{
+    if (co->offset == 0 ||
+        (co->offset && ((m->offset+1) - co->uricontent_len) >= co->offset))
+    {
+        if (co->depth == 0 ||
+            (co->depth && (m->offset+1) <= co->depth))
+        {
+            return 1;
+        }
+    }
+
+    return 0;
+}
+
+/* This function is called recursively (if necessary) to be able
+ * to determite whether or not a chain of content matches connected
+ * with 'within' and 'distance' options fully matches. The reason it
+ * was done like this is to make sure we can handle partial matches
+ * that turn out to fail being followed by full matches later in the
+ * packet. This adds some runtime complexity however. */
+static inline int TestWithinDistanceOffsetDepthUri(ThreadVars *t,
+                                                DetectEngineThreadCtx *det_ctx,
+                                                MpmMatch *m, SigMatch *nsm)
+{
+    //printf("test_nextsigmatch m:%p, nsm:%p\n", m,nsm);
+    if (nsm == NULL)
+        return 1;
+
+    DetectUricontentData *co = (DetectUricontentData *)nsm->ctx;
+    MpmMatch *nm = det_ctx->mtcu.match[co->id].top;
+
+    for (; nm; nm = nm->next) {
+        SCLogDebug("(nm->offset+1) %" PRIu32 ", (m->offset+1) %" PRIu32 "",
+                    (nm->offset+1), (m->offset+1));
+
+        if ((co->within == 0 || (co->within &&
+           ((nm->offset+1) > (m->offset+1)) &&
+           ((nm->offset+1) - (m->offset+1) <= co->within))))
+        {
+             SCLogDebug("WITHIN (nm->offset+1) %" PRIu32 ", (m->offset+1) "
+                        "%" PRIu32 "", (nm->offset+1), (m->offset+1));
+
+            if (co->distance == 0 || (co->distance &&
+               ((nm->offset+1) > (m->offset+1)) &&
+               ((nm->offset+1) - (m->offset+1) >= co->distance)))
+            {
+                if (TestOffsetDepthUri(nm, co) == 1) {
+                      SCLogDebug("DISTANCE (nm->offset+1) %" PRIu32 ", "
+                                 "(m->offset+1) %" PRIu32 "", (nm->offset+1),
+                                 (m->offset+1));
+                    return TestWithinDistanceOffsetDepthUri(t, det_ctx, nm,
+                                                         nsm->next);
+                }
+            }
+        }
+    }
+    return 0;
+}
+
+static inline int DoDetectUricontent(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
+                                     Packet *p, SigMatch *sm,
+                                     DetectUricontentData *co)
+{
+    int ret = 0;
+    char match = 0;
+
+    /* Get the top match, we already know we have one. */
+    MpmMatch *m = det_ctx->mtcu.match[co->id].top;
+
+    /*  if we have within or distance coming up next, check this match
+     *  for distance and/or within and check the rest of this match
+     *  chain as well. */
+    if ((co->flags & DETECT_URICONTENT_WITHIN_NEXT ||
+         co->flags & DETECT_URICONTENT_DISTANCE_NEXT) &&
+         det_ctx->de_checking_distancewithin == 0)
+    {
+        /* indicate to the detection engine the next sigmatch(es)
+         * are part of this match chain */
+        det_ctx->de_checking_distancewithin = 1;
+
+        for (; m != NULL; m = m->next) {
+            /* first check our match for offset and depth */
+            if (TestOffsetDepthUri(m, co) == 1) {
+                ret = TestWithinDistanceOffsetDepthUri(t, det_ctx, m, sm->next);
+                if (ret == 1) {
+                    /* update pkt ptrs, content doesn't use this,
+                     * but pcre does */
+                    det_ctx->pkt_ptr = p->payload + m->offset;
+                    det_ctx->pkt_off = m->offset;
+                    match = 1;
+                    break;
+                }
+            }
+        }
+    /* Okay, this is complicated... on the first match of a match chain,
+     * we do the whole match of that chain (a chain here means a number
+     * of consecutive content matches that relate to each other with
+     * 'within and/or 'distance options'). But we still get to the next
+     * sigmatches. We have already inspected this sigmatch, even for
+     * offset and depth. Since the fact that we get there means we have
+     * had a match, we return match here too.
+     */
+    } else if (co->flags & DETECT_URICONTENT_WITHIN ||
+               co->flags & DETECT_URICONTENT_DISTANCE)
+    {
+        det_ctx->de_checking_distancewithin = 0;
+        match = 1;
+    /* Getting here means we are not in checking an within/distance chain.
+     * This means we can just inspect this content match on it's own. So
+     * Let's see if at least one of the matches within the offset and depth
+     * settings. If so, return a match.
+     */
+    } else {
+        for (; m != NULL; m = m->next) {
+            ret = TestOffsetDepthUri(m,co);
+            if (ret == 1) {
+                /* update pkt ptrs, content doesn't use this,
+                 * but pcre does */
+                det_ctx->pkt_ptr = p->payload + m->offset;
+                det_ctx->pkt_off = m->offset;
+                match = 1;
+                break;
+            }
+        }
+    }
+    return match;
+}
+
+
 #endif /* __DETECT_URICONTENT_H__ */
 
diff --git a/src/detect.c b/src/detect.c
index c4bb56b..8770174 100644
--- a/src/detect.c
+++ b/src/detect.c
@@ -433,60 +433,6 @@ int PacketAlertAppend(Packet *p, uint32_t gid, uint32_t sid, uint8_t rev,
     return 0;
 }
 
-inline SigGroupHead *SigMatchSignaturesGetSgh(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p) {
-    SCEnter();
-
-    int ds,f;
-    SigGroupHead *sgh = NULL;
-
-    /* select the dsize_gh */
-    if (p->payload_len <= 100)
-        ds = 0;
-    else
-        ds = 1;
-
-    /* select the flow_gh */
-    if (p->flowflags & FLOW_PKT_TOCLIENT)
-        f = 0;
-    else
-        f = 1;
-
-    SCLogDebug("ds %d, f %d", ds, f);
-
-    /* find the right mpm instance */
-    DetectAddress *ag = DetectAddressLookupInHead(de_ctx->dsize_gh[ds].flow_gh[f].src_gh[p->proto],&p->src);
-    if (ag != NULL) {
-        /* source group found, lets try a dst group */
-        ag = DetectAddressLookupInHead(ag->dst_gh,&p->dst);
-        if (ag != NULL) {
-            if (ag->port == NULL) {
-                SCLogDebug("we don't have ports");
-                sgh = ag->sh;
-            } else {
-                SCLogDebug("we have ports");
-
-                DetectPort *sport = DetectPortLookupGroup(ag->port,p->sp);
-                if (sport != NULL) {
-                    DetectPort *dport = DetectPortLookupGroup(sport->dst_ph,p->dp);
-                    if (dport != NULL) {
-                        sgh = dport->sh;
-                    } else {
-                        SCLogDebug("no dst port group found for the packet");
-                    }
-                } else {
-                    SCLogDebug("no src port group found for the packet");
-                }
-            }
-        } else {
-            SCLogDebug("no dst address group found for the packet");
-        }
-    } else {
-        SCLogDebug("no src address group found for the packet");
-    }
-
-    SCReturnPtr(sgh, "SigGroupHead");
-}
-
 int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
 {
     int match = 0, fmatch = 0;
diff --git a/src/detect.h b/src/detect.h
index 8de84a9..12d4099 100644
--- a/src/detect.h
+++ b/src/detect.h
@@ -5,8 +5,6 @@
 
 #include "flow.h"
 
-#include "detect-engine-proto.h"
-
 #include "packet-queue.h"
 #include "util-mpm.h"
 #include "util-hash.h"
@@ -21,6 +19,7 @@
 /* forward declarations for the structures from detect-engine-sigorder.h */
 struct SCSigOrderFunc_;
 struct SCSigSignatureWrapper_;
+typedef struct DetectEngineCtx_ DetectEngineCtx;
 
 /*
  * DETECT ADDRESS
@@ -46,6 +45,22 @@ enum {
 #define ADDRESS_PORTS_NOTUNIQ       0x10
 #define ADDRESS_HAVEPORT            0x20
 
+/*
+ * DETECT PORT
+ */
+
+/* a is ... than b */
+enum {
+    PORT_ER = -1, /* error e.g. compare ipv4 and ipv6 */
+    PORT_LT,      /* smaller              [aaa] [bbb] */
+    PORT_LE,      /* smaller with overlap [aa[bab]bb] */
+    PORT_EQ,      /* exactly equal        [abababab]  */
+    PORT_ES,      /* within               [bb[aaa]bb] and [[abab]bbb] and [bbb[abab]] */
+    PORT_EB,      /* completely overlaps  [aa[bbb]aa] and [[baba]aaa] and [aaa[baba]] */
+    PORT_GE,      /* bigger with overlap  [bb[aba]aa] */
+    PORT_GT,      /* bigger               [bbb] [aaa] */
+};
+
 typedef struct DetectAddress_ {
     /* address data for this group */
     uint8_t family;
@@ -68,28 +83,12 @@ typedef struct DetectAddress_ {
     uint32_t cnt;
 } DetectAddress;
 
-/** Signature grouping head. Here 'any', ipv4 and ipv6 are split out */
 typedef struct DetectAddressHead_ {
     DetectAddress *any_head;
     DetectAddress *ipv4_head;
     DetectAddress *ipv6_head;
 } DetectAddressHead;
 
-/*
- * DETECT PORT
- */
-
-/* a is ... than b */
-enum {
-    PORT_ER = -1, /* error e.g. compare ipv4 and ipv6 */
-    PORT_LT,      /* smaller              [aaa] [bbb] */
-    PORT_LE,      /* smaller with overlap [aa[bab]bb] */
-    PORT_EQ,      /* exactly equal        [abababab]  */
-    PORT_ES,      /* within               [bb[aaa]bb] and [[abab]bbb] and [bbb[abab]] */
-    PORT_EB,      /* completely overlaps  [aa[bbb]aa] and [[baba]aaa] and [aaa[baba]] */
-    PORT_GE,      /* bigger with overlap  [bb[aba]aa] */
-    PORT_GT,      /* bigger               [bbb] [aaa] */
-};
 
 #define PORT_FLAG_ANY           0x01 /**< 'any' special port */
 #define PORT_FLAG_NOT           0x02 /**< negated port */
@@ -117,6 +116,11 @@ typedef struct DetectPort_ {
     uint8_t flags;  /**< flags for this port */
 } DetectPort;
 
+#include "detect-engine-proto.h"
+#include "detect-engine-address.h"
+#include "detect-engine-port.h"
+
+
 /* Signature flags */
 #define SIG_FLAG_RECURSIVE 0x0001   /**< recursive capturing enabled */
 #define SIG_FLAG_SRC_ANY   0x0002   /**< source is any */
@@ -238,7 +242,7 @@ typedef struct ThresholdCtx_    {
 } ThresholdCtx;
 
 /** \brief main detection engine ctx */
-typedef struct DetectEngineCtx_ {
+struct DetectEngineCtx_ {
     uint8_t flags;
     uint8_t failure_fatal;
 
@@ -323,7 +327,7 @@ typedef struct DetectEngineCtx_ {
     uint16_t max_uniq_small_toserver_dst_groups;
     uint16_t max_uniq_small_toserver_sp_groups;
     uint16_t max_uniq_small_toserver_dp_groups;
-} DetectEngineCtx;
+};
 
 /* Engine groups profiles (low, medium, high, custom) */
 enum {
@@ -588,5 +592,61 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx,
                        DetectEngineThreadCtx *det_ctx, Packet *p);
 int SignatureIsIPOnly(DetectEngineCtx *de_ctx, Signature *s);
 
+/** ------ inline functions ------ */
+
+static inline SigGroupHead *SigMatchSignaturesGetSgh(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p) {
+    SCEnter();
+
+    int ds,f;
+    SigGroupHead *sgh = NULL;
+
+    /* select the dsize_gh */
+    if (p->payload_len <= 100)
+        ds = 0;
+    else
+        ds = 1;
+
+    /* select the flow_gh */
+    if (p->flowflags & FLOW_PKT_TOCLIENT)
+        f = 0;
+    else
+        f = 1;
+
+    SCLogDebug("ds %d, f %d", ds, f);
+
+    /* find the right mpm instance */
+    DetectAddress *ag = DetectAddressLookupInHead(de_ctx->dsize_gh[ds].flow_gh[f].src_gh[p->proto],&p->src);
+    if (ag != NULL) {
+        /* source group found, lets try a dst group */
+        ag = DetectAddressLookupInHead(ag->dst_gh,&p->dst);
+        if (ag != NULL) {
+            if (ag->port == NULL) {
+                SCLogDebug("we don't have ports");
+                sgh = ag->sh;
+            } else {
+                SCLogDebug("we have ports");
+
+                DetectPort *sport = DetectPortLookupGroup(ag->port,p->sp);
+                if (sport != NULL) {
+                    DetectPort *dport = DetectPortLookupGroup(sport->dst_ph,p->dp);
+                    if (dport != NULL) {
+                        sgh = dport->sh;
+                    } else {
+                        SCLogDebug("no dst port group found for the packet");
+                    }
+                } else {
+                    SCLogDebug("no src port group found for the packet");
+                }
+            }
+        } else {
+            SCLogDebug("no dst address group found for the packet");
+        }
+    } else {
+        SCLogDebug("no src address group found for the packet");
+    }
+
+    SCReturnPtr(sgh, "SigGroupHead");
+}
+
 #endif /* __DETECT_H__ */
 
diff --git a/src/flow.c b/src/flow.c
index fcf90d9..9f2933c 100644
--- a/src/flow.c
+++ b/src/flow.c
@@ -327,42 +327,6 @@ void FlowDecrUsecnt(ThreadVars *tv, Packet *p) {
     SCMutexUnlock(&p->flow->m);
 }
 
-#define TOSERVER 0
-#define TOCLIENT 1
-
-/**
- *  \brief determine the direction of the packet compared to the flow
- *  \retval 0 to_server
- *  \retval 1 to_client
- */
-static inline int FlowGetPacketDirection(Flow *f, Packet *p) {
-    if (p->proto == IPPROTO_TCP || p->proto == IPPROTO_UDP) {
-        if (!(CMP_PORT(p->sp,p->dp))) {
-            /* update flags and counters */
-            if (CMP_PORT(f->sp,p->sp)) {
-                return TOSERVER;
-            } else {
-                return TOCLIENT;
-            }
-        } else {
-            if (CMP_ADDR(&f->src,&p->src)) {
-                return TOSERVER;
-            } else {
-                return TOCLIENT;
-            }
-        }
-    } else if (p->proto == IPPROTO_ICMP || p->proto == IPPROTO_ICMPV6) {
-        if (CMP_ADDR(&f->src,&p->src)) {
-            return TOSERVER;
-        } else {
-            return TOCLIENT;
-        }
-    }
-
-    /* default to toserver */
-    return TOSERVER;
-}
-
 /** \brief Entry point for packet flow handling
  *
  * This is called for every packet.
diff --git a/src/flow.h b/src/flow.h
index 842e8d7..4953484 100644
--- a/src/flow.h
+++ b/src/flow.h
@@ -137,5 +137,43 @@ void FlowSetNoPacketInspectionFlag(Flow *);
 void FlowLockSetNoPayloadInspectionFlag(Flow *);
 void FlowSetNoPayloadInspectionFlag(Flow *);
 
+/** ------ inline functions ------ */
+
+#define TOSERVER 0
+#define TOCLIENT 1
+
+/**
+ *  \brief determine the direction of the packet compared to the flow
+ *  \retval 0 to_server
+ *  \retval 1 to_client
+ */
+static inline int FlowGetPacketDirection(Flow *f, Packet *p) {
+    if (p->proto == IPPROTO_TCP || p->proto == IPPROTO_UDP) {
+        if (!(CMP_PORT(p->sp,p->dp))) {
+            /* update flags and counters */
+            if (CMP_PORT(f->sp,p->sp)) {
+                return TOSERVER;
+            } else {
+                return TOCLIENT;
+            }
+        } else {
+            if (CMP_ADDR(&f->src,&p->src)) {
+                return TOSERVER;
+            } else {
+                return TOCLIENT;
+            }
+        }
+    } else if (p->proto == IPPROTO_ICMP || p->proto == IPPROTO_ICMPV6) {
+        if (CMP_ADDR(&f->src,&p->src)) {
+            return TOSERVER;
+        } else {
+            return TOCLIENT;
+        }
+    }
+
+    /* default to toserver */
+    return TOSERVER;
+}
+
 #endif /* __FLOW_H__ */
 
diff --git a/src/stream-tcp.c b/src/stream-tcp.c
index 8ba3e5d..7854f96 100644
--- a/src/stream-tcp.c
+++ b/src/stream-tcp.c
@@ -382,39 +382,6 @@ TcpSession *StreamTcpNewSession (Packet *p)
     return ssn;
 }
 
-static inline void StreamTcpPacketSetState(Packet *p, TcpSession *ssn,
-                                           uint8_t state)
-{
-    if (state == ssn->state)
-        return;
-
-    ssn->state = state;
-
-    FlowUpdateQueue(p->flow);
-}
-
-/**
- *  \brief  Function to flip the direction When we missed the SYN packet,
- *          SYN/ACK is considered as sent by server, but our engine flagged the
- *          packet as from client for the host whose packet is received first in
- *          the session.
- *
- *  \param  ssn TcpSession to whom this packet belongs
- *  \param  p   Packet whose flag has to be changed
- */
-static inline void StreamTcpPacketSwitchDir(TcpSession *ssn, Packet *p)
-{
-    SCLogDebug("ssn %p: switching pkt direction", ssn);
-
-    if (PKT_IS_TOSERVER(p)) {
-        p->flowflags &= ~FLOW_PKT_TOSERVER;
-        p->flowflags |= FLOW_PKT_TOCLIENT;
-    } else {
-        p->flowflags &= ~FLOW_PKT_TOCLIENT;
-        p->flowflags |= FLOW_PKT_TOSERVER;
-    }
-}
-
 /**
  *  \brief  Function to set the OS policy for the given stream based on the
  *          destination of the received packet.
diff --git a/src/stream-tcp.h b/src/stream-tcp.h
index f817038..ca666eb 100644
--- a/src/stream-tcp.h
+++ b/src/stream-tcp.h
@@ -3,6 +3,11 @@
 #ifndef __STREAM_TCP_H__
 #define __STREAM_TCP_H__
 
+#include "stream-tcp-private.h"
+#include "stream-tcp-reassemble.h"
+#include "stream-tcp.h"
+#include "stream.h"
+
 #define COUNTER_STREAMTCP_STREAMS 1
 
 #define STREAM_VERBOSE    FALSE
@@ -25,5 +30,42 @@ void StreamTcpIncrMemuse(uint32_t);
 void StreamTcpDecrMemuse(uint32_t);
 int StreamTcpCheckMemcap(uint32_t);
 
+/** ------ inline functions ------ */
+
+static inline void StreamTcpPacketSetState(Packet *p, TcpSession *ssn,
+                                           uint8_t state)
+{
+    if (state == ssn->state)
+        return;
+
+    ssn->state = state;
+
+    FlowUpdateQueue(p->flow);
+}
+
+/**
+ *  \brief  Function to flip the direction When we missed the SYN packet,
+ *          SYN/ACK is considered as sent by server, but our engine flagged the
+ *          packet as from client for the host whose packet is received first in
+ *          the session.
+ *
+ *  \param  ssn TcpSession to whom this packet belongs
+ *  \param  p   Packet whose flag has to be changed
+ */
+static inline void StreamTcpPacketSwitchDir(TcpSession *ssn, Packet *p)
+{
+    SCLogDebug("ssn %p: switching pkt direction", ssn);
+
+    if (PKT_IS_TOSERVER(p)) {
+        p->flowflags &= ~FLOW_PKT_TOSERVER;
+        p->flowflags |= FLOW_PKT_TOCLIENT;
+    } else {
+        p->flowflags &= ~FLOW_PKT_TOCLIENT;
+        p->flowflags |= FLOW_PKT_TOSERVER;
+    }
+}
+
+
+
 #endif /* __STREAM_TCP_H__ */
 
diff --git a/src/suricata-common.h b/src/suricata-common.h
index 278a928..0171468 100644
--- a/src/suricata-common.h
+++ b/src/suricata-common.h
@@ -118,5 +118,36 @@
 size_t strlcat(char *, const char *src, size_t siz);
 size_t strlcpy(char *dst, const char *src, size_t siz);
 
+/* uppercase to lowercase conversion lookup table */
+uint8_t g_u8_lowercasetable[256];
+/* marco to do the actual lookup */
+#define u8_tolower(c) g_u8_lowercasetable[(c)]
+
+/** ---- Inline functions ---- */
+static inline void memcpy_tolower(uint8_t *d, uint8_t *s, uint16_t len)
+{
+    uint16_t i;
+    for (i = 0; i < len; i++)
+        d[i] = u8_tolower(s[i]);
+
+    return;
+}
+
+static inline int
+memcmp_lowercase(uint8_t *s1, uint8_t *s2, uint16_t n) {
+    size_t i;
+
+    /* check backwards because we already tested the first
+     * 2 to 4 chars. This way we are more likely to detect
+     * a miss and thus speed up a little... */
+    for (i = n - 1; i; i--) {
+        if (u8_tolower(*(s2+i)) != s1[i])
+            return 1;
+    }
+
+    return 0;
+}
+
+
 #endif /* __SURICATA_COMMON_H__ */
 
diff --git a/src/suricata.h b/src/suricata.h
index 4426786..abb549b 100644
--- a/src/suricata.h
+++ b/src/suricata.h
@@ -52,10 +52,6 @@ PacketQueue trans_q[256];
 /* memset to zeros, and mutex init! */
 void GlobalInits();
 
-/* uppercase to lowercase conversion lookup table */
-uint8_t g_u8_lowercasetable[256];
-/* marco to do the actual lookup */
-#define u8_tolower(c) g_u8_lowercasetable[(c)]
 // these 2 are slower:
 //#define u8_tolower(c) ((c) >= 'A' && (c) <= 'Z') ? g_u8_lowercasetable[(c)] : (c)
 //#define u8_tolower(c) ((c) >= 'A' && (c) <= 'Z') ? ((c) + ('a' - 'A')) : (c)
diff --git a/src/tm-threads.c b/src/tm-threads.c
index f4233c0..926623b 100644
--- a/src/tm-threads.c
+++ b/src/tm-threads.c
@@ -47,68 +47,6 @@ SCMutex tv_root_lock = PTHREAD_MUTEX_INITIALIZER;
    thread encounters a failure.  Defaults to restart the failed thread */
 uint8_t tv_aof = THV_RESTART_THREAD;
 
-typedef struct TmSlot_ {
-    /* function pointers */
-    TmEcode (*SlotFunc)(ThreadVars *, Packet *, void *, PacketQueue *);
-
-    TmEcode (*SlotThreadInit)(ThreadVars *, void *, void **);
-    void (*SlotThreadExitPrintStats)(ThreadVars *, void *);
-    TmEcode (*SlotThreadDeinit)(ThreadVars *, void *);
-
-    /* data storage */
-    void *slot_initdata;
-    void *slot_data;
-    PacketQueue slot_pq;
-
-    /* linked list, only used by TmVarSlot */
-    struct TmSlot_ *slot_next;
-} TmSlot;
-
-/* 1 function slot */
-typedef struct Tm1Slot_ {
-    TmSlot s;
-} Tm1Slot;
-
-/* Variable number of function slots */
-typedef struct TmVarSlot_ {
-    TmSlot *s;
-} TmVarSlot;
-
-/** \retval 1 flag is set
- *  \retval 0 flag is not set
- */
-inline int TmThreadsCheckFlag(ThreadVars *tv, uint8_t flag) {
-    int r;
-    if (SCSpinLock(&tv->flags_spinlock) != 0) {
-        SCLogError(SC_ERR_SPINLOCK,"spin lock errno=%d",errno);
-        return 0;
-    }
-
-    r = (tv->flags & flag);
-   SCSpinUnlock(&tv->flags_spinlock);
-    return r;
-}
-
-inline void TmThreadsSetFlag(ThreadVars *tv, uint8_t flag) {
-    if (SCSpinLock(&tv->flags_spinlock) != 0) {
-        SCLogError(SC_ERR_SPINLOCK,"spin lock errno=%d",errno);
-        return;
-    }
-
-    tv->flags |= flag;
-   SCSpinUnlock(&tv->flags_spinlock);
-}
-
-inline void TmThreadsUnsetFlag(ThreadVars *tv, uint8_t flag) {
-    if (SCSpinLock(&tv->flags_spinlock) != 0) {
-        SCLogError(SC_ERR_SPINLOCK,"spin lock errno=%d",errno);
-        return;
-    }
-
-    tv->flags &= ~flag;
-   SCSpinUnlock(&tv->flags_spinlock);
-}
-
 /* 1 slot functions */
 
 void *TmThreadsSlot1NoIn(void *td) {
@@ -371,44 +309,6 @@ void *TmThreadsSlot1(void *td) {
     pthread_exit((void *) 0);
 }
 
-/* separate run function so we can call it recursively */
-static inline TmEcode TmThreadsSlotVarRun (ThreadVars *tv, Packet *p, TmSlot *slot) {
-    TmEcode r = TM_ECODE_OK;
-    TmSlot *s = NULL;
-
-    for (s = slot; s != NULL; s = s->slot_next) {
-        r = s->SlotFunc(tv, p, s->slot_data, &s->slot_pq);
-        /* handle error */
-        if (r == TM_ECODE_FAILED) {
-            /* Encountered error.  Return packets to packetpool and return */
-            TmqhReleasePacketsToPacketPool(&s->slot_pq);
-            TmThreadsSetFlag(tv, THV_FAILED);
-            return TM_ECODE_FAILED;
-        }
-
-        /* handle new packets */
-        while (s->slot_pq.len > 0) {
-            Packet *extra_p = PacketDequeue(&s->slot_pq);
-
-            /* see if we need to process the packet */
-            if (s->slot_next != NULL) {
-                r = TmThreadsSlotVarRun(tv, extra_p, s->slot_next);
-                /* XXX handle error */
-                if (r == TM_ECODE_FAILED) {
-                    //printf("TmThreadsSlotVarRun: recursive TmThreadsSlotVarRun returned 1\n");
-                    TmqhReleasePacketsToPacketPool(&s->slot_pq);
-                    TmqhOutputPacketpool(tv, extra_p);
-                    TmThreadsSetFlag(tv, THV_FAILED);
-                    return TM_ECODE_FAILED;
-                }
-            }
-            tv->tmqh_out(tv, extra_p);
-        }
-    }
-
-    return TM_ECODE_OK;
-}
-
 void *TmThreadsSlotVar(void *td) {
     ThreadVars *tv = (ThreadVars *)td;
     TmVarSlot *s = (TmVarSlot *)tv->tm_slots;
diff --git a/src/tm-threads.h b/src/tm-threads.h
index ff3d956..c5b186f 100644
--- a/src/tm-threads.h
+++ b/src/tm-threads.h
@@ -2,6 +2,7 @@
 #define __TM_THREADS_H__
 
 #include "tm-modules.h"
+#include "packet-queue.h"
 
 /* ThreadVars type */
 enum {
@@ -10,10 +11,41 @@ enum {
     TVT_MAX,
 };
 
+typedef struct TmSlot_ {
+    /* function pointers */
+    TmEcode (*SlotFunc)(ThreadVars *, Packet *, void *, PacketQueue *);
+
+    TmEcode (*SlotThreadInit)(ThreadVars *, void *, void **);
+    void (*SlotThreadExitPrintStats)(ThreadVars *, void *);
+    TmEcode (*SlotThreadDeinit)(ThreadVars *, void *);
+
+    /* data storage */
+    void *slot_initdata;
+    void *slot_data;
+    PacketQueue slot_pq;
+
+    /* linked list, only used by TmVarSlot */
+    struct TmSlot_ *slot_next;
+} TmSlot;
+
+/* 1 function slot */
+typedef struct Tm1Slot_ {
+    TmSlot s;
+} Tm1Slot;
+
+/* Variable number of function slots */
+typedef struct TmVarSlot_ {
+    TmSlot *s;
+} TmVarSlot;
+
+
 extern ThreadVars *tv_root[TVT_MAX];
 
 extern SCMutex tv_root_lock;
 
+void TmqhReleasePacketsToPacketPool(PacketQueue *);
+void TmqhOutputPacketpool(ThreadVars *, Packet *);
+
 void Tm1SlotSetFunc(ThreadVars *, TmModule *, void *);
 void TmVarSlotSetFuncAppend(ThreadVars *, TmModule *, void *);
 ThreadVars *TmThreadCreate(char *, char *, char *, char *, char *, char *,
@@ -42,9 +74,86 @@ void TmThreadPause(ThreadVars *);
 void TmThreadPauseThreads(void);
 void TmThreadCheckThreadState(void);
 TmEcode TmThreadWaitOnThreadInit(void);
-inline int TmThreadsCheckFlag(ThreadVars *, uint8_t);
-inline void TmThreadsSetFlag(ThreadVars *, uint8_t);
+static inline int TmThreadsCheckFlag(ThreadVars *, uint8_t);
+static inline void TmThreadsSetFlag(ThreadVars *, uint8_t);
 ThreadVars *TmThreadsGetCallingThread(void);
 
+/** ------ inline functions ------ */
+
+static inline TmEcode TmThreadsSlotVarRun (ThreadVars *, Packet *, TmSlot *);
+
+/** \retval 1 flag is set
+ *  \retval 0 flag is not set
+ */
+static inline int TmThreadsCheckFlag(ThreadVars *tv, uint8_t flag) {
+    int r;
+    if (SCSpinLock(&tv->flags_spinlock) != 0) {
+        SCLogError(SC_ERR_SPINLOCK,"spin lock errno=%d",errno);
+        return 0;
+    }
+
+    r = (tv->flags & flag);
+   SCSpinUnlock(&tv->flags_spinlock);
+    return r;
+}
+
+static inline void TmThreadsSetFlag(ThreadVars *tv, uint8_t flag) {
+    if (SCSpinLock(&tv->flags_spinlock) != 0) {
+        SCLogError(SC_ERR_SPINLOCK,"spin lock errno=%d",errno);
+        return;
+    }
+
+    tv->flags |= flag;
+   SCSpinUnlock(&tv->flags_spinlock);
+}
+
+static inline void TmThreadsUnsetFlag(ThreadVars *tv, uint8_t flag) {
+    if (SCSpinLock(&tv->flags_spinlock) != 0) {
+        SCLogError(SC_ERR_SPINLOCK,"spin lock errno=%d",errno);
+        return;
+    }
+
+    tv->flags &= ~flag;
+   SCSpinUnlock(&tv->flags_spinlock);
+}
+
+/* separate run function so we can call it recursively */
+static inline TmEcode TmThreadsSlotVarRun (ThreadVars *tv, Packet *p, TmSlot *slot) {
+    TmEcode r = TM_ECODE_OK;
+    TmSlot *s = NULL;
+
+    for (s = slot; s != NULL; s = s->slot_next) {
+        r = s->SlotFunc(tv, p, s->slot_data, &s->slot_pq);
+        /* handle error */
+        if (r == TM_ECODE_FAILED) {
+            /* Encountered error.  Return packets to packetpool and return */
+            TmqhReleasePacketsToPacketPool(&s->slot_pq);
+            TmThreadsSetFlag(tv, THV_FAILED);
+            return TM_ECODE_FAILED;
+        }
+
+        /* handle new packets */
+        while (s->slot_pq.len > 0) {
+            Packet *extra_p = PacketDequeue(&s->slot_pq);
+
+            /* see if we need to process the packet */
+            if (s->slot_next != NULL) {
+                r = TmThreadsSlotVarRun(tv, extra_p, s->slot_next);
+                /* XXX handle error */
+                if (r == TM_ECODE_FAILED) {
+                    //printf("TmThreadsSlotVarRun: recursive TmThreadsSlotVarRun returned 1\n");
+                    TmqhReleasePacketsToPacketPool(&s->slot_pq);
+                    TmqhOutputPacketpool(tv, extra_p);
+                    TmThreadsSetFlag(tv, THV_FAILED);
+                    return TM_ECODE_FAILED;
+                }
+            }
+            tv->tmqh_out(tv, extra_p);
+        }
+    }
+
+    return TM_ECODE_OK;
+}
+
 #endif /* __TM_THREADS_H__ */
 
diff --git a/src/util-byte.c b/src/util-byte.c
index 121d822..4cfdf22 100644
--- a/src/util-byte.c
+++ b/src/util-byte.c
@@ -5,341 +5,6 @@
 
 /** \todo: Remove the fprintf errors in favor of logging */
 
-int ByteExtract(uint64_t *res, int e, uint16_t len, const uint8_t *bytes)
-{
-    uint64_t b = 0;
-    int i;
-
-    if ((e != BYTE_BIG_ENDIAN) && (e != BYTE_LITTLE_ENDIAN)) {
-        /** \todo Need standard return values */
-        return -1;
-    }
-
-    *res = 0;
-
-    /* Go through each byte and merge it into the result in the correct order */
-    /** \todo Probably a more efficient way to do this. */
-    for (i = 0; i < len; i++) {
-
-        if (e == BYTE_LITTLE_ENDIAN) {
-            b = bytes[i];
-        }
-        else {
-            b = bytes[len - i - 1];
-        }
-
-        *res |= (b << ((i & 7) << 3));
-
-    }
-
-    return len;
-}
-
-inline int ByteExtractUint64(uint64_t *res, int e, uint16_t len, const uint8_t *bytes)
-{
-    uint64_t i64;
-    int ret;
-
-    /* Uint64 is limited to 8 bytes */
-    if (len > 8) {
-        /** \todo Need standard return values */
-        return -1;
-    }
-
-    ret = ByteExtract(&i64, e, len, bytes);
-    if (ret <= 0) {
-        return ret;
-    }
-
-    *res = (uint64_t)i64;
-
-    return ret;
-}
-
-inline int ByteExtractUint32(uint32_t *res, int e, uint16_t len, const uint8_t *bytes)
-{
-    uint64_t i64;
-    int ret;
-
-    /* Uint32 is limited to 4 bytes */
-    if (len > 4) {
-        /** \todo Need standard return values */
-        return -1;
-    }
-
-    ret = ByteExtract(&i64, e, len, bytes);
-    if (ret <= 0) {
-        return ret;
-    }
-
-    *res = (uint32_t)i64;
-
-    return ret;
-}
-
-inline int ByteExtractUint16(uint16_t *res, int e, uint16_t len, const uint8_t *bytes)
-{
-    uint64_t i64;
-    int ret;
-
-    /* Uint16 is limited to 2 bytes */
-    if (len > 2) {
-        /** \todo Need standard return values */
-        return -1;
-    }
-
-    ret = ByteExtract(&i64, e, len, bytes);
-    if (ret <= 0) {
-        return ret;
-    }
-
-    *res = (uint16_t)i64;
-
-    return ret;
-}
-
-int ByteExtractString(uint64_t *res, int base, uint16_t len, const char *str)
-{
-    const char *ptr = str;
-    char *endptr = NULL;
-
-    /* 23 - This is the largest string (octal, with a zero prefix) that
-     *      will not overflow uint64_t.  The only way this length
-     *      could be over 23 and still not overflow is if it were zero
-     *      prefixed and we only support 1 byte of zero prefix for octal.
-     *
-     * "01777777777777777777777" = 0xffffffffffffffff
-     */
-    char strbuf[24];
-
-    if (len > 23) {
-        SCLogError(SC_ERR_ARG_LEN_LONG, "len too large (23 max)");
-        return -1;
-    }
-
-    if (len) {
-        /* Extract out the string so it can be null terminated */
-        memcpy(strbuf, str, len);
-        strbuf[len] = '\0';
-        ptr = strbuf;
-    }
-
-    errno = 0;
-    *res = strtoull(ptr, &endptr, base);
-
-    if (errno == ERANGE) {
-        SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range");
-        return -1;
-    } else if (endptr == str) {
-        SCLogError(SC_ERR_INVALID_NUMERIC_VALUE, "Invalid numeric value");
-        return -1;
-    /* If there is no numeric value in the given string then strtoull(), makes
-       endptr equals to ptr and return 0 as result */
-    } else if (endptr == ptr && *res == 0) {
-        SCLogDebug("No numeric value");
-        return -1;
-    }
-    /* This will interfere with some rules that do not know the length
-     * in advance and instead are just using the max.
-     */
-#if 0
-    else if (len && *endptr != '\0') {
-        fprintf(stderr, "ByteExtractString: Extra characters following numeric value\n");
-        return -1;
-    }
-#endif
-
-    return (endptr - ptr);
-}
-
-inline int ByteExtractStringUint64(uint64_t *res, int base, uint16_t len, const char *str)
-{
-    return ByteExtractString(res, base, len, str);
-}
-
-inline int ByteExtractStringUint32(uint32_t *res, int base, uint16_t len, const char *str)
-{
-    uint64_t i64;
-    int ret;
-
-    ret = ByteExtractString(&i64, base, len, str);
-    if (ret <= 0) {
-        return ret;
-    }
-
-    *res = (uint32_t)i64;
-
-    if ((uint64_t)(*res) != i64) {
-        SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range "
-                   "(%" PRIx64 " != %" PRIx64 ")", (uint64_t)(*res), i64);
-        return -1;
-    }
-
-    return ret;
-}
-
-inline int ByteExtractStringUint16(uint16_t *res, int base, uint16_t len, const char *str)
-{
-    uint64_t i64;
-    int ret;
-
-    ret = ByteExtractString(&i64, base, len, str);
-    if (ret <= 0) {
-        return ret;
-    }
-
-    *res = (uint16_t)i64;
-
-    if ((uint64_t)(*res) != i64) {
-        SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range "
-                   "(%" PRIx64 " != %" PRIx64 ")", (uint64_t)(*res), i64);
-        return -1;
-    }
-
-    return ret;
-}
-
-inline int ByteExtractStringUint8(uint8_t *res, int base, uint16_t len, const char *str)
-{
-    uint64_t i64;
-    int ret;
-
-    ret = ByteExtractString(&i64, base, len, str);
-    if (ret <= 0) {
-        return ret;
-    }
-
-    *res = (uint8_t)i64;
-
-    if ((uint64_t)(*res) != i64) {
-        SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range "
-                   "(%" PRIx64 " != %" PRIx64 ")", (uint64_t)(*res), i64);
-        return -1;
-    }
-
-    return ret;
-}
-
-int ByteExtractStringSigned(int64_t *res, int base, uint16_t len, const char *str)
-{
-    const char *ptr = str;
-    char *endptr;
-
-    /* 23 - This is the largest string (octal, with a zero prefix) that
-     *      will not overflow int64_t.  The only way this length
-     *      could be over 23 and still not overflow is if it were zero
-     *      prefixed and we only support 1 byte of zero prefix for octal.
-     *
-     * "-0777777777777777777777" = 0xffffffffffffffff
-     */
-    char strbuf[24];
-
-    if (len > 23) {
-        SCLogError(SC_ERR_ARG_LEN_LONG, "len too large (23 max)");
-        return -1;
-    }
-
-    if (len) {
-        /* Extract out the string so it can be null terminated */
-        memcpy(strbuf, str, len);
-        strbuf[len] = '\0';
-        ptr = strbuf;
-    }
-
-    errno = 0;
-    *res = strtoll(ptr, &endptr, base);
-
-    if (errno == ERANGE) {
-        SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range");
-        return -1;
-    } else if (endptr == str) {
-        SCLogError(SC_ERR_INVALID_NUMERIC_VALUE, "Invalid numeric value");
-        return -1;
-    }
-    /* This will interfere with some rules that do not know the length
-     * in advance and instead are just using the max.
-     */
-#if 0
-    else if (len && *endptr != '\0') {
-        fprintf(stderr, "ByteExtractStringSigned: Extra characters following numeric value\n");
-        return -1;
-    }
-#endif
-
-    //fprintf(stderr, "ByteExtractStringSigned: Extracted base %d: 0x%" PRIx64 "\n", base, *res);
-
-    return (endptr - ptr);
-}
-
-inline int ByteExtractStringInt64(int64_t *res, int base, uint16_t len, const char *str)
-{
-    return ByteExtractStringSigned(res, base, len, str);
-}
-
-inline int ByteExtractStringInt32(int32_t *res, int base, uint16_t len, const char *str)
-{
-    int64_t i64;
-    int ret;
-
-    ret = ByteExtractStringSigned(&i64, base, len, str);
-    if (ret <= 0) {
-        return ret;
-    }
-
-    *res = (int32_t)i64;
-
-    if ((int64_t)(*res) != i64) {
-        SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range "
-                   "(%" PRIx64 " != %" PRIx64 ")\n", (int64_t)(*res), i64);
-        return -1;
-    }
-
-    return ret;
-}
-
-inline int ByteExtractStringInt16(int16_t *res, int base, uint16_t len, const char *str)
-{
-    int64_t i64;
-    int ret;
-
-    ret = ByteExtractStringSigned(&i64, base, len, str);
-    if (ret <= 0) {
-        return ret;
-    }
-
-    *res = (int16_t)i64;
-
-    if ((int64_t)(*res) != i64) {
-        SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range "
-                   "(%" PRIx64 " != %" PRIx64 ")\n", (int64_t)(*res), i64);
-        return -1;
-    }
-
-    return ret;
-}
-
-inline int ByteExtractStringInt8(int8_t *res, int base, uint16_t len, const char *str)
-{
-    int64_t i64;
-    int ret;
-
-    ret = ByteExtractStringSigned(&i64, base, len, str);
-    if (ret <= 0) {
-        return ret;
-    }
-
-    *res = (int8_t)i64;
-
-    if ((int64_t)(*res) != i64) {
-        SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range "
-                   "(%" PRIx64 " != %" PRIx64 ")\n", (int64_t)(*res), i64);
-        return -1;
-    }
-
-    return ret;
-}
-
-/* UNITTESTS */
 #ifdef UNITTESTS
 
 static int ByteTest01 (void) {
diff --git a/src/util-byte.h b/src/util-byte.h
index ee54ffb..704fd90 100644
--- a/src/util-byte.h
+++ b/src/util-byte.h
@@ -59,7 +59,7 @@
  * \return n Number of bytes extracted on success
  * \return -1 On error
  */
-int ByteExtractUint64(uint64_t *res, int e, uint16_t len, const uint8_t *bytes);
+static inline int ByteExtractUint64(uint64_t *res, int e, uint16_t len, const uint8_t *bytes);
 
 /**
  * Extract bytes from a byte string and convert to a unint32_t.
@@ -72,7 +72,7 @@ int ByteExtractUint64(uint64_t *res, int e, uint16_t len, const uint8_t *bytes);
  * \return n Number of bytes extracted on success
  * \return -1 On error
  */
-inline int ByteExtractUint32(uint32_t *res, int e, uint16_t len, const uint8_t *bytes);
+static inline int ByteExtractUint32(uint32_t *res, int e, uint16_t len, const uint8_t *bytes);
 
 /**
  * Extract bytes from a byte string and convert to a unint16_t.
@@ -85,7 +85,7 @@ inline int ByteExtractUint32(uint32_t *res, int e, uint16_t len, const uint8_t *
  * \return n Number of bytes extracted on success
  * \return -1 On error
  */
-inline int ByteExtractUint16(uint16_t *res, int e, uint16_t len, const uint8_t *bytes);
+static inline int ByteExtractUint16(uint16_t *res, int e, uint16_t len, const uint8_t *bytes);
 
 /**
  * Extract unsigned integer value from a string.
@@ -98,7 +98,7 @@ inline int ByteExtractUint16(uint16_t *res, int e, uint16_t len, const uint8_t *
  * \return n Number of bytes extracted on success
  * \return -1 On error
  */
-inline int ByteExtractString(uint64_t *res, int base, uint16_t len, const char *str);
+static inline int ByteExtractString(uint64_t *res, int base, uint16_t len, const char *str);
 
 /**
  * Extract unsigned integer value from a string as uint64_t.
@@ -112,7 +112,7 @@ inline int ByteExtractString(uint64_t *res, int base, uint16_t len, const char *
  * \return n Number of bytes extracted on success
  * \return -1 On error
  */
-inline int ByteExtractStringUint64(uint64_t *res, int base, uint16_t len, const char *str);
+static inline int ByteExtractStringUint64(uint64_t *res, int base, uint16_t len, const char *str);
 
 /**
  * Extract unsigned integer value from a string as uint32_t.
@@ -125,7 +125,7 @@ inline int ByteExtractStringUint64(uint64_t *res, int base, uint16_t len, const
  * \return n Number of bytes extracted on success
  * \return -1 On error
  */
-inline int ByteExtractStringUint32(uint32_t *res, int base, uint16_t len, const char *str);
+static inline int ByteExtractStringUint32(uint32_t *res, int base, uint16_t len, const char *str);
 
 /**
  * Extract unsigned integer value from a string as uint16_t.
@@ -138,7 +138,7 @@ inline int ByteExtractStringUint32(uint32_t *res, int base, uint16_t len, const
  * \return n Number of bytes extracted on success
  * \return -1 On error
  */
-inline int ByteExtractStringUint16(uint16_t *res, int base, uint16_t len, const char *str);
+static inline int ByteExtractStringUint16(uint16_t *res, int base, uint16_t len, const char *str);
 
 /**
  * Extract unsigned integer value from a string as uint8_t.
@@ -151,7 +151,7 @@ inline int ByteExtractStringUint16(uint16_t *res, int base, uint16_t len, const
  * \return n Number of bytes extracted on success
  * \return -1 On error
  */
-inline int ByteExtractStringUint8(uint8_t *res, int base, uint16_t len, const char *str);
+static inline int ByteExtractStringUint8(uint8_t *res, int base, uint16_t len, const char *str);
 
 /**
  * Extract signed integer value from a string.
@@ -164,7 +164,7 @@ inline int ByteExtractStringUint8(uint8_t *res, int base, uint16_t len, const ch
  * \return n Number of bytes extracted on success
  * \return -1 On error
  */
-inline int ByteExtractStringSigned(int64_t *res, int base, uint16_t len, const char *str);
+static inline int ByteExtractStringSigned(int64_t *res, int base, uint16_t len, const char *str);
 
 /**
  * Extract signed integer value from a string as uint64_t.
@@ -177,7 +177,7 @@ inline int ByteExtractStringSigned(int64_t *res, int base, uint16_t len, const c
  * \return n Number of bytes extracted on success
  * \return -1 On error
  */
-inline int ByteExtractStringInt64(int64_t *res, int base, uint16_t len, const char *str);
+static inline int ByteExtractStringInt64(int64_t *res, int base, uint16_t len, const char *str);
 
 /**
  * Extract signed integer value from a string as uint32_t.
@@ -190,7 +190,7 @@ inline int ByteExtractStringInt64(int64_t *res, int base, uint16_t len, const ch
  * \return n Number of bytes extracted on success
  * \return -1 On error
  */
-inline int ByteExtractStringInt32(int32_t *res, int base, uint16_t len, const char *str);
+static inline int ByteExtractStringInt32(int32_t *res, int base, uint16_t len, const char *str);
 
 /**
  * Extract signed integer value from a string as uint16_t.
@@ -203,7 +203,7 @@ inline int ByteExtractStringInt32(int32_t *res, int base, uint16_t len, const ch
  * \return n Number of bytes extracted on success
  * \return -1 On error
  */
-inline int ByteExtractStringInt16(int16_t *res, int base, uint16_t len, const char *str);
+static inline int ByteExtractStringInt16(int16_t *res, int base, uint16_t len, const char *str);
 
 /**
  * Extract signed integer value from a string as uint8_t.
@@ -216,7 +216,346 @@ inline int ByteExtractStringInt16(int16_t *res, int base, uint16_t len, const ch
  * \return n Number of bytes extracted on success
  * \return -1 On error
  */
-inline int ByteExtractStringInt8(int8_t *res, int base, uint16_t len, const char *str);
+static inline int ByteExtractStringInt8(int8_t *res, int base, uint16_t len, const char *str);
+
+/** ------ Definitions of Inline functions ------ */
+
+
+static inline int ByteExtract(uint64_t *res, int e, uint16_t len, const uint8_t *bytes)
+{
+    uint64_t b = 0;
+    int i;
+
+    if ((e != BYTE_BIG_ENDIAN) && (e != BYTE_LITTLE_ENDIAN)) {
+        /** \todo Need standard return values */
+        return -1;
+    }
+
+    *res = 0;
+
+    /* Go through each byte and merge it into the result in the correct order */
+    /** \todo Probably a more efficient way to do this. */
+    for (i = 0; i < len; i++) {
+
+        if (e == BYTE_LITTLE_ENDIAN) {
+            b = bytes[i];
+        }
+        else {
+            b = bytes[len - i - 1];
+        }
+
+        *res |= (b << ((i & 7) << 3));
+
+    }
+
+    return len;
+}
+
+static inline int ByteExtractString(uint64_t *res, int base, uint16_t len, const char *str)
+{
+    const char *ptr = str;
+    char *endptr = NULL;
+
+    /* 23 - This is the largest string (octal, with a zero prefix) that
+     *      will not overflow uint64_t.  The only way this length
+     *      could be over 23 and still not overflow is if it were zero
+     *      prefixed and we only support 1 byte of zero prefix for octal.
+     *
+     * "01777777777777777777777" = 0xffffffffffffffff
+     */
+    char strbuf[24];
+
+    if (len > 23) {
+        SCLogError(SC_ERR_ARG_LEN_LONG, "len too large (23 max)");
+        return -1;
+    }
+
+    if (len) {
+        /* Extract out the string so it can be null terminated */
+        memcpy(strbuf, str, len);
+        strbuf[len] = '\0';
+        ptr = strbuf;
+    }
+
+    errno = 0;
+    *res = strtoull(ptr, &endptr, base);
+
+    if (errno == ERANGE) {
+        SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range");
+        return -1;
+    } else if (endptr == str) {
+        SCLogError(SC_ERR_INVALID_NUMERIC_VALUE, "Invalid numeric value");
+        return -1;
+    /* If there is no numeric value in the given string then strtoull(), makes
+       endptr equals to ptr and return 0 as result */
+    } else if (endptr == ptr && *res == 0) {
+        SCLogDebug("No numeric value");
+        return -1;
+    }
+    /* This will interfere with some rules that do not know the length
+     * in advance and instead are just using the max.
+     */
+#if 0
+    else if (len && *endptr != '\0') {
+        fprintf(stderr, "ByteExtractString: Extra characters following numeric value\n");
+        return -1;
+    }
+#endif
+
+    return (endptr - ptr);
+}
+
+static inline int ByteExtractUint64(uint64_t *res, int e, uint16_t len, const uint8_t *bytes)
+{
+    uint64_t i64;
+    int ret;
+
+    /* Uint64 is limited to 8 bytes */
+    if (len > 8) {
+        /** \todo Need standard return values */
+        return -1;
+    }
+
+    ret = ByteExtract(&i64, e, len, bytes);
+    if (ret <= 0) {
+        return ret;
+    }
+
+    *res = (uint64_t)i64;
+
+    return ret;
+}
+
+static inline int ByteExtractUint32(uint32_t *res, int e, uint16_t len, const uint8_t *bytes)
+{
+    uint64_t i64;
+    int ret;
+
+    /* Uint32 is limited to 4 bytes */
+    if (len > 4) {
+        /** \todo Need standard return values */
+        return -1;
+    }
+
+    ret = ByteExtract(&i64, e, len, bytes);
+    if (ret <= 0) {
+        return ret;
+    }
+
+    *res = (uint32_t)i64;
+
+    return ret;
+}
+
+static inline int ByteExtractUint16(uint16_t *res, int e, uint16_t len, const uint8_t *bytes)
+{
+    uint64_t i64;
+    int ret;
+
+    /* Uint16 is limited to 2 bytes */
+    if (len > 2) {
+        /** \todo Need standard return values */
+        return -1;
+    }
+
+    ret = ByteExtract(&i64, e, len, bytes);
+    if (ret <= 0) {
+        return ret;
+    }
+
+    *res = (uint16_t)i64;
+
+    return ret;
+}
+
+
+static inline int ByteExtractStringInt64(int64_t *res, int base, uint16_t len, const char *str)
+{
+    return ByteExtractStringSigned(res, base, len, str);
+}
+
+static inline int ByteExtractStringInt32(int32_t *res, int base, uint16_t len, const char *str)
+{
+    int64_t i64;
+    int ret;
+
+    ret = ByteExtractStringSigned(&i64, base, len, str);
+    if (ret <= 0) {
+        return ret;
+    }
+
+    *res = (int32_t)i64;
+
+    if ((int64_t)(*res) != i64) {
+        SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range "
+                   "(%" PRIx64 " != %" PRIx64 ")\n", (int64_t)(*res), i64);
+        return -1;
+    }
+
+    return ret;
+}
+
+static inline int ByteExtractStringInt16(int16_t *res, int base, uint16_t len, const char *str)
+{
+    int64_t i64;
+    int ret;
+
+    ret = ByteExtractStringSigned(&i64, base, len, str);
+    if (ret <= 0) {
+        return ret;
+    }
+
+    *res = (int16_t)i64;
+
+    if ((int64_t)(*res) != i64) {
+        SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range "
+                   "(%" PRIx64 " != %" PRIx64 ")\n", (int64_t)(*res), i64);
+        return -1;
+    }
+
+    return ret;
+}
+
+static inline int ByteExtractStringInt8(int8_t *res, int base, uint16_t len, const char *str)
+{
+    int64_t i64;
+    int ret;
+
+    ret = ByteExtractStringSigned(&i64, base, len, str);
+    if (ret <= 0) {
+        return ret;
+    }
+
+    *res = (int8_t)i64;
+
+    if ((int64_t)(*res) != i64) {
+        SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range "
+                   "(%" PRIx64 " != %" PRIx64 ")\n", (int64_t)(*res), i64);
+        return -1;
+    }
+
+    return ret;
+}
+
+static inline int ByteExtractStringUint64(uint64_t *res, int base, uint16_t len, const char *str)
+{
+    return ByteExtractString(res, base, len, str);
+}
+
+static inline int ByteExtractStringUint32(uint32_t *res, int base, uint16_t len, const char *str)
+{
+    uint64_t i64;
+    int ret;
+
+    ret = ByteExtractString(&i64, base, len, str);
+    if (ret <= 0) {
+        return ret;
+    }
+
+    *res = (uint32_t)i64;
+
+    if ((uint64_t)(*res) != i64) {
+        SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range "
+                   "(%" PRIx64 " != %" PRIx64 ")", (uint64_t)(*res), i64);
+        return -1;
+    }
+
+    return ret;
+}
+
+static inline int ByteExtractStringUint16(uint16_t *res, int base, uint16_t len, const char *str)
+{
+    uint64_t i64;
+    int ret;
+
+    ret = ByteExtractString(&i64, base, len, str);
+    if (ret <= 0) {
+        return ret;
+    }
+
+    *res = (uint16_t)i64;
+
+    if ((uint64_t)(*res) != i64) {
+        SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range "
+                   "(%" PRIx64 " != %" PRIx64 ")", (uint64_t)(*res), i64);
+        return -1;
+    }
+
+    return ret;
+}
+
+static inline int ByteExtractStringUint8(uint8_t *res, int base, uint16_t len, const char *str)
+{
+    uint64_t i64;
+    int ret;
+
+    ret = ByteExtractString(&i64, base, len, str);
+    if (ret <= 0) {
+        return ret;
+    }
+
+    *res = (uint8_t)i64;
+
+    if ((uint64_t)(*res) != i64) {
+        SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range "
+                   "(%" PRIx64 " != %" PRIx64 ")", (uint64_t)(*res), i64);
+        return -1;
+    }
+
+    return ret;
+}
+
+static inline int ByteExtractStringSigned(int64_t *res, int base, uint16_t len, const char *str)
+{
+    const char *ptr = str;
+    char *endptr;
+
+    /* 23 - This is the largest string (octal, with a zero prefix) that
+     *      will not overflow int64_t.  The only way this length
+     *      could be over 23 and still not overflow is if it were zero
+     *      prefixed and we only support 1 byte of zero prefix for octal.
+     *
+     * "-0777777777777777777777" = 0xffffffffffffffff
+     */
+    char strbuf[24];
+
+    if (len > 23) {
+        SCLogError(SC_ERR_ARG_LEN_LONG, "len too large (23 max)");
+        return -1;
+    }
+
+    if (len) {
+        /* Extract out the string so it can be null terminated */
+        memcpy(strbuf, str, len);
+        strbuf[len] = '\0';
+        ptr = strbuf;
+    }
+
+    errno = 0;
+    *res = strtoll(ptr, &endptr, base);
+
+    if (errno == ERANGE) {
+        SCLogError(SC_ERR_NUMERIC_VALUE_ERANGE, "Numeric value out of range");
+        return -1;
+    } else if (endptr == str) {
+        SCLogError(SC_ERR_INVALID_NUMERIC_VALUE, "Invalid numeric value");
+        return -1;
+    }
+    /* This will interfere with some rules that do not know the length
+     * in advance and instead are just using the max.
+     */
+#if 0
+    else if (len && *endptr != '\0') {
+        fprintf(stderr, "ByteExtractStringSigned: Extra characters following numeric value\n");
+        return -1;
+    }
+#endif
+
+    //fprintf(stderr, "ByteExtractStringSigned: Extracted base %d: 0x%" PRIx64 "\n", base, *res);
+
+    return (endptr - ptr);
+}
+/* UNITTESTS */
 
 #ifdef UNITTESTS
 void ByteRegisterTests(void);
diff --git a/src/util-classification-config.c b/src/util-classification-config.c
index b25e03a..19169f8 100644
--- a/src/util-classification-config.c
+++ b/src/util-classification-config.c
@@ -14,24 +14,8 @@
 #include "util-debug.h"
 #include "util-fmemopen.h"
 
-/* Regex to parse the classtype argument from a Signature.  The first substring
- * holds the classtype name, the second substring holds the classtype the
- * classtype description, and the third argument holds the priority */
-#define DETECT_CLASSCONFIG_REGEX "^\\s*config\\s*classification\\s*:\\s*([a-zA-Z][a-zA-Z0-9-_]*)\\s*,\\s*(.+)\\s*,\\s*(\\d+)\\s*$"
-
-/* Default path for the classification.config file */
-#define SC_CLASS_CONF_DEF_CONF_FILEPATH "classification.config"
-
 /* Holds a pointer to the default path for the classification.config file */
-static const char *default_file_path = SC_CLASS_CONF_DEF_CONF_FILEPATH;
-static FILE *fd = NULL;
-static pcre *regex = NULL;
-static pcre_extra *regex_study = NULL;
-
-uint32_t SCClassConfClasstypeHashFunc(HashTable *ht, void *data, uint16_t datalen);
-char SCClassConfClasstypeHashCompareFunc(void *data1, uint16_t datalen1,
-                                         void *data2, uint16_t datalen2);
-void SCClassConfClasstypeHashFree(void *ch);
+static const char *classification_default_file_path = SC_CLASS_CONF_DEF_CONF_FILEPATH;
 
 /**
  * \brief Returns the path for the Classification Config file.  We check if we
@@ -42,9 +26,9 @@ void SCClassConfClasstypeHashFree(void *ch);
  * \retval log_filename Pointer to a string containing the path for the
  *                      Classification Config file.
  */
-static char *SCClassConfGetConfFilename(void)
+char *SCClassConfGetConfFilename(void)
 {
-    char *log_filename = (char *)default_file_path;
+    char *log_filename = (char *)classification_default_file_path;
 
     ConfGet("classification-file", &log_filename);
 
@@ -52,86 +36,13 @@ static char *SCClassConfGetConfFilename(void)
 }
 
 /**
- * \brief Inits the context to be used by the Classification Config parsing API.
- *
- *        This function initializes the hash table to be used by the Detection
- *        Engine Context to hold the data from the classification.config file,
- *        obtains the file desc to parse the classification.config file, and
- *        inits the regex used to parse the lines from classification.config
- *        file.
- *
- * \param de_ctx Pointer to the Detection Engine Context.
- *
- * \retval  0 On success.
- * \retval -1 On failure.
- */
-static inline int SCClassConfInitContext(DetectEngineCtx *de_ctx)
-{
-    char *filename = NULL;
-    const char *eb = NULL;
-    int eo;
-    int opts = 0;
-
-    /* init the hash table to be used by the classification config Classtypes */
-    de_ctx->class_conf_ht = HashTableInit(4096, SCClassConfClasstypeHashFunc,
-                                          SCClassConfClasstypeHashCompareFunc,
-                                          SCClassConfClasstypeHashFree);
-    if (de_ctx->class_conf_ht == NULL) {
-        SCLogError(SC_ERR_HASH_TABLE_INIT, "Error initializing the hash "
-                   "table");
-        return -1;
-    }
-
-    /* if it is not NULL, use the file descriptor.  The hack so that we can
-     * avoid using a dummy classification file for testing purposes and
-     * instead use an input stream against a buffer containing the
-     * classification strings */
-    if (fd == NULL) {
-        filename = SCClassConfGetConfFilename();
-        if ( (fd = fopen(filename, "r")) == NULL) {
-            SCLogError(SC_ERR_FOPEN, "Error opening file: \"%s\": %s", filename, strerror(errno));
-            goto error;
-        }
-    }
-
-    regex = pcre_compile(DETECT_CLASSCONFIG_REGEX, opts, &eb, &eo, NULL);
-    if (regex == NULL) {
-        SCLogDebug("Compile of \"%s\" failed at offset %" PRId32 ": %s",
-                   DETECT_CLASSCONFIG_REGEX, eo, eb);
-        goto error;
-    }
-
-    regex_study = pcre_study(regex, 0, &eb);
-    if (eb != NULL) {
-        SCLogDebug("pcre study failed: %s", eb);
-        goto error;
-    }
-
-    return 0;
-
- error:
-    if (de_ctx->class_conf_ht != NULL) {
-        HashTableFree(de_ctx->class_conf_ht);
-        de_ctx->class_conf_ht = NULL;
-    }
-    if (fd != NULL) {
-        fclose(fd);
-        fd = NULL;
-    }
-
-    printf("\nPlease check the \"classification-file\" option in your suricata.yaml file.\n");
-    exit(EXIT_FAILURE);
-//    return -1;
-}
-
-/**
  * \brief Releases resources used by the Classification Config API.
  */
-static void SCClassConfDeInitContext(DetectEngineCtx *de_ctx)
+void SCClassConfDeInitContext(DetectEngineCtx *de_ctx)
 {
 
     fclose(fd);
-    default_file_path = SC_CLASS_CONF_DEF_CONF_FILEPATH;
+    classification_default_file_path = SC_CLASS_CONF_DEF_CONF_FILEPATH;
     fd = NULL;
     return;
 }
@@ -141,7 +52,7 @@ static void SCClassConfDeInitContext(DetectEngineCtx *de_ctx)
  *
  * \param str Pointer to the string to be converted.
  */
-static char *SCClassConfStringToLowercase(const char *str)
+char *SCClassConfStringToLowercase(const char *str)
 {
     char *new_str = NULL;
     char *temp_str = NULL;
@@ -161,81 +72,6 @@ static char *SCClassConfStringToLowercase(const char *str)
 }
 
 /**
- * \brief Parses a line from the classification file and adds it to Classtype
- *        hash table in DetectEngineCtx, i.e. DetectEngineCtx->class_conf_ht.
- *
- * \param rawstr Pointer to the string to be parsed.
- * \param de_ctx Pointer to the Detection Engine Context.
- *
- * \retval  0 On success.
- * \retval -1 On failure.
- */
-static inline int SCClassConfAddClasstype(char *rawstr, DetectEngineCtx *de_ctx)
-{
-    const char *ct_name = NULL;
-    const char *ct_desc = NULL;
-    const char *ct_priority_str = NULL;
-    int ct_priority = 0;
-
-    SCClassConfClasstype *ct_new = NULL;
-    SCClassConfClasstype *ct_lookup = NULL;
-
-#define MAX_SUBSTRINGS 30
-    int ret = 0;
-    int ov[MAX_SUBSTRINGS];
-
-    ret = pcre_exec(regex, regex_study, rawstr, strlen(rawstr), 0, 0, ov, 30);
-    if (ret < 0) {
-        SCLogError(SC_ERR_INVALID_SIGNATURE, "Invalid Classtype in "
-                   "classification.config file");
-        goto error;
-    }
-
-    /* retrieve the classtype name */
-    ret = pcre_get_substring((char *)rawstr, ov, 30, 1, &ct_name);
-    if (ret < 0) {
-        SCLogInfo("pcre_get_substring() failed");
-        goto error;
-    }
-
-    /* retrieve the classtype description */
-    ret = pcre_get_substring((char *)rawstr, ov, 30, 2, &ct_desc);
-    if (ret < 0) {
-        SCLogInfo("pcre_get_substring() failed");
-        goto error;
-    }
-
-    /* retrieve the classtype priority */
-    ret = pcre_get_substring((char *)rawstr, ov, 30, 3, &ct_priority_str);
-    if (ret < 0) {
-        SCLogInfo("pcre_get_substring() failed");
-        goto error;
-    }
-
-    ct_priority = atoi(ct_priority_str);
-
-    /* Create a new instance of the parsed Classtype string */
-    ct_new = SCClassConfAllocClasstype(ct_name, ct_desc, ct_priority);
-    if (ct_new == NULL)
-        goto error;
-
-    /* Check if the Classtype is present in the HashTable.  In case it's present
-     * ignore it, as it is a duplicate.  If not present, add it to the table */
-    ct_lookup = HashTableLookup(de_ctx->class_conf_ht, ct_new, 0);
-    if (ct_lookup == NULL) {
-        if (HashTableAdd(de_ctx->class_conf_ht, ct_new, 0) < 0)
-            SCLogDebug("HashTable Add failed");
-    } else {
-        SCLogDebug("Duplicate classtype found inside classification.config");
-    }
-
-    return 0;
-
- error:
-    return -1;
-}
-
-/**
  * \brief Checks if a string is a comment or a blank line.
  *
  *        Comments lines are lines of the following format -
@@ -247,7 +83,7 @@ static inline int SCClassConfAddClasstype(char *rawstr, DetectEngineCtx *de_ctx)
  * \retval 1 On the argument string being a comment or blank line
  * \retval 0 Otherwise
  */
-static int SCClassConfIsLineBlankOrComment(char *line)
+int SCClassConfIsLineBlankOrComment(char *line)
 {
     while (*line != '\0') {
         /* we have a comment */
@@ -266,31 +102,6 @@ static int SCClassConfIsLineBlankOrComment(char *line)
 }
 
 /**
- * \brief Parses the Classification Config file and updates the
- *        DetectionEngineCtx->class_conf_ht with the Classtype information.
- *
- * \param de_ctx Pointer to the Detection Engine Context.
- */
-static inline void SCClassConfParseFile(DetectEngineCtx *de_ctx)
-{
-    char line[1024];
-
-    while (fgets(line, sizeof(line), fd) != NULL) {
-        if (SCClassConfIsLineBlankOrComment(line))
-            continue;
-
-        SCClassConfAddClasstype(line, de_ctx);
-    }
-
-#ifdef UNITTESTS
-    SCLogInfo("Added \"%d\" classification types from the classification file",
-              de_ctx->class_conf_ht->count);
-#endif
-
-    return;
-}
-
-/**
  * \brief Returns a new SCClassConfClasstype instance.  The classtype string
  *        is converted into lowercase, before being assigned to the instance.
  *
diff --git a/src/util-classification-config.h b/src/util-classification-config.h
index effca75..b4ab75e 100644
--- a/src/util-classification-config.h
+++ b/src/util-classification-config.h
@@ -5,6 +5,18 @@
 #ifndef __UTIL_CLASSIFICATION_CONFIG_H__
 #define __UTIL_CLASSIFICATION_CONFIG_H__
 
+/* Regex to parse the classtype argument from a Signature.  The first substring
+ * holds the classtype name, the second substring holds the classtype the
+ * classtype description, and the third argument holds the priority */
+#define DETECT_CLASSCONFIG_REGEX "^\\s*config\\s*classification\\s*:\\s*([a-zA-Z][a-zA-Z0-9-_]*)\\s*,\\s*(.+)\\s*,\\s*(\\d+)\\s*$"
+
+/* Default path for the classification.config file */
+#define SC_CLASS_CONF_DEF_CONF_FILEPATH "classification.config"
+
+static FILE *fd = NULL;
+static pcre *classification_regex = NULL;
+static pcre_extra *classification_regex_study = NULL;
+
 /**
  * \brief Container for a Classtype from the Classification.config file.
  */
@@ -31,4 +43,189 @@ void SCClassConfGenerateInValidDummyClassConfigFD02(void);
 void SCClassConfGenerateInValidDummyClassConfigFD03(void);
 void SCClassConfDeleteDummyClassificationConfigFD(void);
 
+uint32_t SCClassConfClasstypeHashFunc(HashTable *ht, void *data, uint16_t datalen);
+char SCClassConfClasstypeHashCompareFunc(void *data1, uint16_t datalen1,
+                                         void *data2, uint16_t datalen2);
+void SCClassConfClasstypeHashFree(void *ch);
+
+char* SCClassConfGetConfFilename(void);
+int SCClassConfIsLineBlankOrComment(char *);
+
+/** ------- Inline functions ------ */
+
+
+/**
+ * \brief Inits the context to be used by the Classification Config parsing API.
+ *
+ *        This function initializes the hash table to be used by the Detection
+ *        Engine Context to hold the data from the classification.config file,
+ *        obtains the file desc to parse the classification.config file, and
+ *        inits the classification_regex used to parse the lines from classification.config
+ *        file.
+ *
+ * \param de_ctx Pointer to the Detection Engine Context.
+ *
+ * \retval  0 On success.
+ * \retval -1 On failure.
+ */
+static inline int SCClassConfInitContext(DetectEngineCtx *de_ctx)
+{
+    char *filename = NULL;
+    const char *eb = NULL;
+    int eo;
+    int opts = 0;
+
+    /* init the hash table to be used by the classification config Classtypes */
+    de_ctx->class_conf_ht = HashTableInit(4096, SCClassConfClasstypeHashFunc,
+                                          SCClassConfClasstypeHashCompareFunc,
+                                          SCClassConfClasstypeHashFree);
+    if (de_ctx->class_conf_ht == NULL) {
+        SCLogError(SC_ERR_HASH_TABLE_INIT, "Error initializing the hash "
+                   "table");
+        return -1;
+    }
+
+    /* if it is not NULL, use the file descriptor.  The hack so that we can
+     * avoid using a dummy classification file for testing purposes and
+     * instead use an input stream against a buffer containing the
+     * classification strings */
+    if (fd == NULL) {
+        filename = SCClassConfGetConfFilename();
+        if ( (fd = fopen(filename, "r")) == NULL) {
+            SCLogError(SC_ERR_FOPEN, "Error opening file: \"%s\": %s", filename, strerror(errno));
+            goto error;
+        }
+    }
+
+    classification_regex = pcre_compile(DETECT_CLASSCONFIG_REGEX, opts, &eb, &eo, NULL);
+    if (classification_regex == NULL) {
+        SCLogDebug("Compile of \"%s\" failed at offset %" PRId32 ": %s",
+                   DETECT_CLASSCONFIG_REGEX, eo, eb);
+        goto error;
+    }
+
+    classification_regex_study = pcre_study(classification_regex, 0, &eb);
+    if (eb != NULL) {
+        SCLogDebug("pcre study failed: %s", eb);
+        goto error;
+    }
+
+    return 0;
+
+ error:
+    if (de_ctx->class_conf_ht != NULL) {
+        HashTableFree(de_ctx->class_conf_ht);
+        de_ctx->class_conf_ht = NULL;
+    }
+    if (fd != NULL) {
+        fclose(fd);
+        fd = NULL;
+    }
+
+    printf("\nPlease check the \"classification-file\" option in your suricata.yaml file.\n");
+    exit(EXIT_FAILURE);
+//    return -1;
+}
+
+/**
+ * \brief Parses a line from the classification file and adds it to Classtype
+ *        hash table in DetectEngineCtx, i.e. DetectEngineCtx->class_conf_ht.
+ *
+ * \param rawstr Pointer to the string to be parsed.
+ * \param de_ctx Pointer to the Detection Engine Context.
+ *
+ * \retval  0 On success.
+ * \retval -1 On failure.
+ */
+static inline int SCClassConfAddClasstype(char *rawstr, DetectEngineCtx *de_ctx)
+{
+    const char *ct_name = NULL;
+    const char *ct_desc = NULL;
+    const char *ct_priority_str = NULL;
+    int ct_priority = 0;
+
+    SCClassConfClasstype *ct_new = NULL;
+    SCClassConfClasstype *ct_lookup = NULL;
+
+#define MAX_SUBSTRINGS 30
+    int ret = 0;
+    int ov[MAX_SUBSTRINGS];
+
+    ret = pcre_exec(classification_regex, classification_regex_study, rawstr, strlen(rawstr), 0, 0, ov, 30);
+    if (ret < 0) {
+        SCLogError(SC_ERR_INVALID_SIGNATURE, "Invalid Classtype in "
+                   "classification.config file");
+        goto error;
+    }
+
+    /* retrieve the classtype name */
+    ret = pcre_get_substring((char *)rawstr, ov, 30, 1, &ct_name);
+    if (ret < 0) {
+        SCLogInfo("pcre_get_substring() failed");
+        goto error;
+    }
+
+    /* retrieve the classtype description */
+    ret = pcre_get_substring((char *)rawstr, ov, 30, 2, &ct_desc);
+    if (ret < 0) {
+        SCLogInfo("pcre_get_substring() failed");
+        goto error;
+    }
+
+    /* retrieve the classtype priority */
+    ret = pcre_get_substring((char *)rawstr, ov, 30, 3, &ct_priority_str);
+    if (ret < 0) {
+        SCLogInfo("pcre_get_substring() failed");
+        goto error;
+    }
+
+    ct_priority = atoi(ct_priority_str);
+
+    /* Create a new instance of the parsed Classtype string */
+    ct_new = SCClassConfAllocClasstype(ct_name, ct_desc, ct_priority);
+    if (ct_new == NULL)
+        goto error;
+
+    /* Check if the Classtype is present in the HashTable.  In case it's present
+     * ignore it, as it is a duplicate.  If not present, add it to the table */
+    ct_lookup = HashTableLookup(de_ctx->class_conf_ht, ct_new, 0);
+    if (ct_lookup == NULL) {
+        if (HashTableAdd(de_ctx->class_conf_ht, ct_new, 0) < 0)
+            SCLogDebug("HashTable Add failed");
+    } else {
+        SCLogDebug("Duplicate classtype found inside classification.config");
+    }
+
+    return 0;
+
+ error:
+    return -1;
+}
+
+/**
+ * \brief Parses the Classification Config file and updates the
+ *        DetectionEngineCtx->class_conf_ht with the Classtype information.
+ *
+ * \param de_ctx Pointer to the Detection Engine Context.
+ */
+static inline void SCClassConfParseFile(DetectEngineCtx *de_ctx)
+{
+    char line[1024];
+
+    while (fgets(line, sizeof(line), fd) != NULL) {
+        if (SCClassConfIsLineBlankOrComment(line))
+            continue;
+
+        SCClassConfAddClasstype(line, de_ctx);
+    }
+
+#ifdef UNITTESTS
+    SCLogInfo("Added \"%d\" classification types from the classification file",
+              de_ctx->class_conf_ht->count);
+#endif
+
+    return;
+}
+
+
 #endif /* __UTIL_CLASSIFICATION_CONFIG_H__ */
diff --git a/src/util-debug-filters.c b/src/util-debug-filters.c
index d9906ce..dbdf4bf 100644
--- a/src/util-debug-filters.c
+++ b/src/util-debug-filters.c
@@ -27,23 +27,23 @@ int sc_log_fd_filters_present = 0;
 /**
  * \brief Holds the fine-grained filters
  */
-static SCLogFGFilterFile *sc_log_fg_filters[SC_LOG_FILTER_MAX] = { NULL, NULL };
+SCLogFGFilterFile *sc_log_fg_filters[SC_LOG_FILTER_MAX] = { NULL, NULL };
 
 /**
  * \brief Mutex for accessing the fine-grained fiters sc_log_fg_filters
  */
-static SCMutex sc_log_fg_filters_m[SC_LOG_FILTER_MAX] = { PTHREAD_MUTEX_INITIALIZER,
+SCMutex sc_log_fg_filters_m[SC_LOG_FILTER_MAX] = { PTHREAD_MUTEX_INITIALIZER,
                                                                   PTHREAD_MUTEX_INITIALIZER };
 
 /**
  * \brief Holds the function-dependent filters
  */
-static SCLogFDFilter *sc_log_fd_filters = NULL;
+SCLogFDFilter *sc_log_fd_filters = NULL;
 
 /**
  * \brief Mutex for accessing the function-dependent filters sc_log_fd_filters
  */
-static SCMutex sc_log_fd_filters_m = PTHREAD_MUTEX_INITIALIZER;
+SCMutex sc_log_fd_filters_m = PTHREAD_MUTEX_INITIALIZER;
 
 /**
  * \brief Holds the thread_list required by function-dependent filters
@@ -55,271 +55,6 @@ static SCLogFDFilterThreadList *sc_log_fd_filters_tl = NULL;
  */
 static SCMutex sc_log_fd_filters_tl_m = PTHREAD_MUTEX_INITIALIZER;
 
-
-/**
- * \brief Helper function used internally to add a FG filter.  This function is
- *        called when the file component of the incoming filter has no entry
- *        in the filter list.
- *
- * \param fgf_file The file component(basically the position in the list) from
- *                 the filter list, after which the new filter has to be added
- * \param file     File_name of the filter
- * \param function Function_name of the filter
- * \param line     Line number of the filter
- * \param listtype The filter listtype.  Can be either a blacklist or whitelist
- *                 filter listtype(SC_LOG_FILTER_BL or SC_LOG_FILTER_WL)
- */
-static inline void SCLogAddToFGFFileList(SCLogFGFilterFile *fgf_file,
-                                         const char *file,
-                                         const char *function, int line,
-                                         int listtype)
-{
-    SCLogFGFilterFile *fgf_file_temp = NULL;
-    SCLogFGFilterFunc *fgf_func_temp = NULL;
-    SCLogFGFilterLine *fgf_line_temp = NULL;
-
-    if ( (fgf_file_temp = SCMalloc(sizeof(SCLogFGFilterFile))) == NULL) {
-        printf("Error Allocating memory\n");
-        exit(EXIT_FAILURE);
-    }
-    memset(fgf_file_temp, 0, sizeof(SCLogFGFilterFile));
-
-    if ( file != NULL && (fgf_file_temp->file = SCStrdup(file)) == NULL) {
-        printf("Error Allocating memory\n");
-        exit(EXIT_FAILURE);
-    }
-
-    if ( (fgf_func_temp = SCMalloc(sizeof(SCLogFGFilterFunc))) == NULL) {
-        printf("Error Allocating memory\n");
-        exit(EXIT_FAILURE);
-    }
-    memset(fgf_func_temp, 0, sizeof(SCLogFGFilterFunc));
-
-    if ( function != NULL && (fgf_func_temp->func = SCStrdup(function)) == NULL) {
-        printf("Error Allocating memory\n");
-        exit(EXIT_FAILURE);
-    }
-
-    if ( (fgf_line_temp = SCMalloc(sizeof(SCLogFGFilterLine))) == NULL) {
-        printf("Error Allocating memory\n");
-        exit(EXIT_FAILURE);
-    }
-    memset(fgf_line_temp, 0, sizeof(SCLogFGFilterLine));
-
-    fgf_line_temp->line = line;
-
-    /* add to the lists */
-    fgf_func_temp->line = fgf_line_temp;
-
-    fgf_file_temp->func = fgf_func_temp;
-
-    if (fgf_file == NULL)
-        sc_log_fg_filters[listtype] = fgf_file_temp;
-    else
-        fgf_file->next = fgf_file_temp;
-
-    return;
-}
-
-/**
- * \brief Helper function used internally to add a FG filter.  This function is
- *        called when the file component of the incoming filter has an entry
- *        in the filter list, but the function component doesn't have an entry
- *        for the corresponding file component
- *
- * \param fgf_file The file component from the filter list to which the new
- *                 filter has to be added
- * \param fgf_func The function component(basically the position in the list),
- *                 from the filter list, after which the new filter has to be
- *                 added
- * \param function Function_name of the filter
- * \param line     Line number of the filter
- */
-static inline void SCLogAddToFGFFuncList(SCLogFGFilterFile *fgf_file,
-                                         SCLogFGFilterFunc *fgf_func,
-                                         const char *function, int line)
-{
-    SCLogFGFilterFunc *fgf_func_temp = NULL;
-    SCLogFGFilterLine *fgf_line_temp = NULL;
-
-    if ( (fgf_func_temp = SCMalloc(sizeof(SCLogFGFilterFunc))) == NULL) {
-        printf("Error Allocating memory\n");
-        exit(EXIT_FAILURE);
-    }
-    memset(fgf_func_temp, 0, sizeof(SCLogFGFilterFunc));
-
-    if ( function != NULL && (fgf_func_temp->func = SCStrdup(function)) == NULL) {
-        printf("Error Allocating memory\n");
-        exit(EXIT_FAILURE);
-    }
-
-    if ( (fgf_line_temp = SCMalloc(sizeof(SCLogFGFilterLine))) == NULL) {
-        printf("Error Allocating memory\n");
-        exit(EXIT_FAILURE);
-    }
-    memset(fgf_line_temp, 0, sizeof(SCLogFGFilterLine));
-
-    fgf_line_temp->line = line;
-
-    /* add to the lists */
-    fgf_func_temp->line = fgf_line_temp;
-
-    if (fgf_func == NULL)
-        fgf_file->func = fgf_func_temp;
-    else
-        fgf_func->next = fgf_func_temp;
-
-    return;
-}
-
-/**
- * \brief Helper function used internally to add a FG filter.  This function is
- *        called when the file and function components of the incoming filter
- *        have an entry in the filter list, but the line component doesn't have
- *        an entry for the corresponding function component
- *
- * \param fgf_func The function component from the filter list to which the new
- *                 filter has to be added
- * \param fgf_line The function component(basically the position in the list),
- *                 from the filter list, after which the new filter has to be
- *                 added
- * \param line     Line number of the filter
- */
-static inline void SCLogAddToFGFLineList(SCLogFGFilterFunc *fgf_func,
-                                         SCLogFGFilterLine *fgf_line,
-                                         int line)
-{
-    SCLogFGFilterLine *fgf_line_temp = NULL;
-
-    if ( (fgf_line_temp = SCMalloc(sizeof(SCLogFGFilterLine))) == NULL) {
-        printf("Error Allocating memory\n");
-        exit(EXIT_FAILURE);
-    }
-    memset(fgf_line_temp, 0, sizeof(SCLogFGFilterLine));
-
-    fgf_line_temp->line = line;
-
-    /* add to the lists */
-    if (fgf_line == NULL)
-        fgf_func->line = fgf_line_temp;
-    else
-        fgf_line->next = fgf_line_temp;
-
-    return;
-}
-
-/**
- * \brief Helper function used internally to add a FG filter
- *
- * \param file     File_name of the filter
- * \param function Function_name of the filter
- * \param line     Line number of the filter
- * \param listtype The filter listtype.  Can be either a blacklist or whitelist
- *                 filter listtype(SC_LOG_FILTER_BL or SC_LOG_FILTER_WL)
- *
- * \retval  0 on successfully adding the filter;
- * \retval -1 on failure
- */
-static inline int SCLogAddFGFilter(const char *file, const char *function,
-                                   int line, int listtype)
-{
-    SCLogFGFilterFile *fgf_file = NULL;
-    SCLogFGFilterFile *prev_fgf_file = NULL;
-
-    SCLogFGFilterFunc *fgf_func = NULL;
-    SCLogFGFilterFunc *prev_fgf_func = NULL;
-
-    SCLogFGFilterLine *fgf_line = NULL;
-    SCLogFGFilterLine *prev_fgf_line = NULL;
-
-    int found = 0;
-
-    if (sc_log_module_initialized != 1) {
-        printf("Logging module not initialized.  Call SCLogInitLogModule() "
-               "first before using the debug API\n");
-        return -1 ;
-    }
-
-    if (file == NULL && function == NULL && line < 0) {
-        printf("Error: Invalid arguments supplied to SCLogAddFGFilter\n");
-        return -1;
-    }
-
-    SCMutex *m = &sc_log_fg_filters_m[listtype];
-
-    SCMutexLock(m);
-
-    fgf_file = sc_log_fg_filters[listtype];
-
-    prev_fgf_file = fgf_file;
-    while (fgf_file != NULL) {
-        prev_fgf_file = fgf_file;
-        if (file == NULL && fgf_file->file == NULL)
-            found = 1;
-        else if (file != NULL && fgf_file->file != NULL)
-            found = (strcmp(file, fgf_file->file) == 0);
-        else
-            found = 0;
-
-        if (found == 1)
-            break;
-
-        fgf_file = fgf_file->next;
-    }
-
-    if (found == 0) {
-        SCLogAddToFGFFileList(prev_fgf_file, file, function, line, listtype);
-        goto done;
-    }
-
-    found = 0;
-    fgf_func = fgf_file->func;
-    prev_fgf_func = fgf_func;
-    while (fgf_func != NULL) {
-        prev_fgf_func = fgf_func;
-        if (function == NULL && fgf_func->func == NULL)
-            found = 1;
-        else if (function != NULL && fgf_func->func != NULL)
-            found = (strcmp(function, fgf_func->func) == 0);
-        else
-            found = 0;
-
-        if (found == 1)
-            break;
-
-        fgf_func = fgf_func->next;
-    }
-
-    if (found == 0) {
-        SCLogAddToFGFFuncList(fgf_file, prev_fgf_func, function, line);
-        goto done;
-    }
-
-    found = 0;
-    fgf_line = fgf_func->line;
-    prev_fgf_line = fgf_line;
-    while(fgf_line != NULL) {
-        prev_fgf_line = fgf_line;
-        if (line == fgf_line->line) {
-            found = 1;
-            break;
-        }
-
-        fgf_line = fgf_line->next;
-    }
-
-    if (found == 0) {
-        SCLogAddToFGFLineList(fgf_func, prev_fgf_line, line);
-        goto done;
-    }
-
- done:
-    SCMutexUnlock(&sc_log_fg_filters_m[listtype]);
-    sc_log_fg_filters_present = 1;
-
-    return 0;
-}
-
 /**
  * \brief Internal function used to check for matches against registered FG
  *        filters.  Checks if there is a match for the incoming log_message with
@@ -607,22 +342,6 @@ int SCLogPrintFGFilters()
  */
 
 /**
- * \brief Releases the memory alloted to a FD filter
- *
- * \param Pointer to the FD filter that has to be freed
- */
-static inline void SCLogReleaseFDFilter(SCLogFDFilter *fdf)
-{
-    if (fdf != NULL) {
-        if (fdf->func != NULL)
-            SCFree(fdf->func);
-        SCFree(fdf);
-    }
-
-    return;
-}
-
-/**
  * \brief Checks if there is a match for the incoming log_message with any
  *        of the FD filters
  *
diff --git a/src/util-debug-filters.h b/src/util-debug-filters.h
index 0bd1661..f76a722 100644
--- a/src/util-debug-filters.h
+++ b/src/util-debug-filters.h
@@ -7,6 +7,9 @@
 
 #include <pthread.h>
 #include "threads.h"
+#include "suricata-common.h"
+#include "util-mem.h"
+#include "util-debug.h"
 
 /**
  * \brief Enum that holds the different kinds of filters available
@@ -99,4 +102,298 @@ int SCLogMatchFDFilter(const char *);
 
 int SCLogPrintFGFilters(void);
 
+/** ------- Inline funcionts ------ */
+
+extern int sc_log_module_initialized;
+extern int sc_log_module_cleaned;
+extern SCMutex sc_log_fg_filters_m[2];
+extern SCLogFGFilterFile *sc_log_fg_filters[2];
+
+static inline void SCLogAddToFGFFileList(SCLogFGFilterFile *,
+                                         const char *,
+                                         const char *,
+                                         int, int);
+
+/**
+ * \brief Helper function used internally to add a FG filter.  This function is
+ *        called when the file component of the incoming filter has an entry
+ *        in the filter list, but the function component doesn't have an entry
+ *        for the corresponding file component
+ *
+ * \param fgf_file The file component from the filter list to which the new
+ *                 filter has to be added
+ * \param fgf_func The function component(basically the position in the list),
+ *                 from the filter list, after which the new filter has to be
+ *                 added
+ * \param function Function_name of the filter
+ * \param line     Line number of the filter
+ */
+static inline void SCLogAddToFGFFuncList(SCLogFGFilterFile *fgf_file,
+                                         SCLogFGFilterFunc *fgf_func,
+                                         const char *function, int line)
+{
+    SCLogFGFilterFunc *fgf_func_temp = NULL;
+    SCLogFGFilterLine *fgf_line_temp = NULL;
+
+    if ( (fgf_func_temp = SCMalloc(sizeof(SCLogFGFilterFunc))) == NULL) {
+        printf("Error Allocating memory\n");
+        exit(EXIT_FAILURE);
+    }
+    memset(fgf_func_temp, 0, sizeof(SCLogFGFilterFunc));
+
+    if ( function != NULL && (fgf_func_temp->func = SCStrdup(function)) == NULL) {
+        printf("Error Allocating memory\n");
+        exit(EXIT_FAILURE);
+    }
+
+    if ( (fgf_line_temp = SCMalloc(sizeof(SCLogFGFilterLine))) == NULL) {
+        printf("Error Allocating memory\n");
+        exit(EXIT_FAILURE);
+    }
+    memset(fgf_line_temp, 0, sizeof(SCLogFGFilterLine));
+
+    fgf_line_temp->line = line;
+
+    /* add to the lists */
+    fgf_func_temp->line = fgf_line_temp;
+
+    if (fgf_func == NULL)
+        fgf_file->func = fgf_func_temp;
+    else
+        fgf_func->next = fgf_func_temp;
+
+    return;
+}
+
+/**
+ * \brief Helper function used internally to add a FG filter.  This function is
+ *        called when the file and function components of the incoming filter
+ *        have an entry in the filter list, but the line component doesn't have
+ *        an entry for the corresponding function component
+ *
+ * \param fgf_func The function component from the filter list to which the new
+ *                 filter has to be added
+ * \param fgf_line The function component(basically the position in the list),
+ *                 from the filter list, after which the new filter has to be
+ *                 added
+ * \param line     Line number of the filter
+ */
+static inline void SCLogAddToFGFLineList(SCLogFGFilterFunc *fgf_func,
+                                         SCLogFGFilterLine *fgf_line,
+                                         int line)
+{
+    SCLogFGFilterLine *fgf_line_temp = NULL;
+
+    if ( (fgf_line_temp = SCMalloc(sizeof(SCLogFGFilterLine))) == NULL) {
+        printf("Error Allocating memory\n");
+        exit(EXIT_FAILURE);
+    }
+    memset(fgf_line_temp, 0, sizeof(SCLogFGFilterLine));
+
+    fgf_line_temp->line = line;
+
+    /* add to the lists */
+    if (fgf_line == NULL)
+        fgf_func->line = fgf_line_temp;
+    else
+        fgf_line->next = fgf_line_temp;
+
+    return;
+}
+
+/**
+ * \brief Helper function used internally to add a FG filter
+ *
+ * \param file     File_name of the filter
+ * \param function Function_name of the filter
+ * \param line     Line number of the filter
+ * \param listtype The filter listtype.  Can be either a blacklist or whitelist
+ *                 filter listtype(SC_LOG_FILTER_BL or SC_LOG_FILTER_WL)
+ *
+ * \retval  0 on successfully adding the filter;
+ * \retval -1 on failure
+ */
+static inline int SCLogAddFGFilter(const char *file, const char *function,
+                                   int line, int listtype)
+{
+    SCLogFGFilterFile *fgf_file = NULL;
+    SCLogFGFilterFile *prev_fgf_file = NULL;
+
+    SCLogFGFilterFunc *fgf_func = NULL;
+    SCLogFGFilterFunc *prev_fgf_func = NULL;
+
+    SCLogFGFilterLine *fgf_line = NULL;
+    SCLogFGFilterLine *prev_fgf_line = NULL;
+
+    int found = 0;
+
+    if (sc_log_module_initialized != 1) {
+        printf("Logging module not initialized.  Call SCLogInitLogModule() "
+               "first before using the debug API\n");
+        return -1 ;
+    }
+
+    if (file == NULL && function == NULL && line < 0) {
+        printf("Error: Invalid arguments supplied to SCLogAddFGFilter\n");
+        return -1;
+    }
+
+    SCMutex *m = &sc_log_fg_filters_m[listtype];
+
+    SCMutexLock(m);
+
+    fgf_file = sc_log_fg_filters[listtype];
+
+    prev_fgf_file = fgf_file;
+    while (fgf_file != NULL) {
+        prev_fgf_file = fgf_file;
+        if (file == NULL && fgf_file->file == NULL)
+            found = 1;
+        else if (file != NULL && fgf_file->file != NULL)
+            found = (strcmp(file, fgf_file->file) == 0);
+        else
+            found = 0;
+
+        if (found == 1)
+            break;
+
+        fgf_file = fgf_file->next;
+    }
+
+    if (found == 0) {
+        SCLogAddToFGFFileList(prev_fgf_file, file, function, line, listtype);
+        goto done;
+    }
+
+    found = 0;
+    fgf_func = fgf_file->func;
+    prev_fgf_func = fgf_func;
+    while (fgf_func != NULL) {
+        prev_fgf_func = fgf_func;
+        if (function == NULL && fgf_func->func == NULL)
+            found = 1;
+        else if (function != NULL && fgf_func->func != NULL)
+            found = (strcmp(function, fgf_func->func) == 0);
+        else
+            found = 0;
+
+        if (found == 1)
+            break;
+
+        fgf_func = fgf_func->next;
+    }
+
+    if (found == 0) {
+        SCLogAddToFGFFuncList(fgf_file, prev_fgf_func, function, line);
+        goto done;
+    }
+
+    found = 0;
+    fgf_line = fgf_func->line;
+    prev_fgf_line = fgf_line;
+    while(fgf_line != NULL) {
+        prev_fgf_line = fgf_line;
+        if (line == fgf_line->line) {
+            found = 1;
+            break;
+        }
+
+        fgf_line = fgf_line->next;
+    }
+
+    if (found == 0) {
+        SCLogAddToFGFLineList(fgf_func, prev_fgf_line, line);
+        goto done;
+    }
+
+ done:
+    SCMutexUnlock(&sc_log_fg_filters_m[listtype]);
+    sc_log_fg_filters_present = 1;
+
+    return 0;
+}
+
+
+/**
+ * \brief Helper function used internally to add a FG filter.  This function is
+ *        called when the file component of the incoming filter has no entry
+ *        in the filter list.
+ *
+ * \param fgf_file The file component(basically the position in the list) from
+ *                 the filter list, after which the new filter has to be added
+ * \param file     File_name of the filter
+ * \param function Function_name of the filter
+ * \param line     Line number of the filter
+ * \param listtype The filter listtype.  Can be either a blacklist or whitelist
+ *                 filter listtype(SC_LOG_FILTER_BL or SC_LOG_FILTER_WL)
+ */
+static inline void SCLogAddToFGFFileList(SCLogFGFilterFile *fgf_file,
+                                         const char *file,
+                                         const char *function, int line,
+                                         int listtype)
+{
+    SCLogFGFilterFile *fgf_file_temp = NULL;
+    SCLogFGFilterFunc *fgf_func_temp = NULL;
+    SCLogFGFilterLine *fgf_line_temp = NULL;
+
+    if ( (fgf_file_temp = SCMalloc(sizeof(SCLogFGFilterFile))) == NULL) {
+        printf("Error Allocating memory\n");
+        exit(EXIT_FAILURE);
+    }
+    memset(fgf_file_temp, 0, sizeof(SCLogFGFilterFile));
+
+    if ( file != NULL && (fgf_file_temp->file = SCStrdup(file)) == NULL) {
+        printf("Error Allocating memory\n");
+        exit(EXIT_FAILURE);
+    }
+
+    if ( (fgf_func_temp = SCMalloc(sizeof(SCLogFGFilterFunc))) == NULL) {
+        printf("Error Allocating memory\n");
+        exit(EXIT_FAILURE);
+    }
+    memset(fgf_func_temp, 0, sizeof(SCLogFGFilterFunc));
+
+    if ( function != NULL && (fgf_func_temp->func = SCStrdup(function)) == NULL) {
+        printf("Error Allocating memory\n");
+        exit(EXIT_FAILURE);
+    }
+
+    if ( (fgf_line_temp = SCMalloc(sizeof(SCLogFGFilterLine))) == NULL) {
+        printf("Error Allocating memory\n");
+        exit(EXIT_FAILURE);
+    }
+    memset(fgf_line_temp, 0, sizeof(SCLogFGFilterLine));
+
+    fgf_line_temp->line = line;
+
+    /* add to the lists */
+    fgf_func_temp->line = fgf_line_temp;
+
+    fgf_file_temp->func = fgf_func_temp;
+
+    if (fgf_file == NULL)
+        sc_log_fg_filters[listtype] = fgf_file_temp;
+    else
+        fgf_file->next = fgf_file_temp;
+
+    return;
+}
+
+/**
+ * \brief Releases the memory alloted to a FD filter
+ *
+ * \param Pointer to the FD filter that has to be freed
+ */
+static inline void SCLogReleaseFDFilter(SCLogFDFilter *fdf)
+{
+    if (fdf != NULL) {
+        if (fdf->func != NULL)
+            SCFree(fdf->func);
+        SCFree(fdf);
+    }
+
+    return;
+}
+
+
 #endif /* __DEBUG_H__ */
diff --git a/src/util-debug.c b/src/util-debug.c
index d72cc15..e22c00f 100644
--- a/src/util-debug.c
+++ b/src/util-debug.c
@@ -4,8 +4,8 @@
 
 #include "suricata-common.h"
 #include "threads.h"
-#include "util-debug.h"
 #include "util-error.h"
+#include "util-debug.h"
 #include "util-enum.h"
 #include "util-debug-filters.h"
 
@@ -23,8 +23,13 @@
 
 #include "conf.h"
 
+/**
+ * \brief Holds the config state for the logging module
+ */
+static SCLogConfig *sc_log_config = NULL;
+
 /* holds the string-enum mapping for the enums held in the table SCLogLevel */
-SCEnumCharMap sc_log_level_map[ ] = {
+SCEnumCharMap sc_log_level_map[11] = {
     { "Not set",        SC_LOG_NOTSET},
     { "None",           SC_LOG_NONE },
     { "Emergency",      SC_LOG_EMERGENCY },
@@ -39,7 +44,7 @@ SCEnumCharMap sc_log_level_map[ ] = {
 };
 
 /* holds the string-enum mapping for the enums held in the table SCLogOPIface */
-SCEnumCharMap sc_log_op_iface_map[ ] = {
+SCEnumCharMap sc_log_op_iface_map[4] = {
     { "Console",        SC_LOG_OP_IFACE_CONSOLE },
     { "File",           SC_LOG_OP_IFACE_FILE },
     { "Syslog",         SC_LOG_OP_IFACE_SYSLOG },
@@ -47,7 +52,7 @@ SCEnumCharMap sc_log_op_iface_map[ ] = {
 };
 
 /* holds the string-enum mapping for the syslog facility in SCLogOPIfaceCtx */
-SCEnumCharMap sc_syslog_facility_map[] = {
+SCEnumCharMap sc_syslog_facility_map[22] = {
     { "auth",           LOG_AUTH },
     { "authpriv",       LOG_AUTHPRIV },
     { "cron",           LOG_CRON },
@@ -72,15 +77,6 @@ SCEnumCharMap sc_syslog_facility_map[] = {
     { NULL,             -1         }
 };
 
-/**
- * \brief Holds the config state for the logging module
- */
-static SCLogConfig *sc_log_config = NULL;
-
-/**
- * \brief Returns the full path given a file and configured log dir
- */
-static char *SCLogGetLogFilename(char *);
 
 /**
  * \brief Holds the global log level.  Is the same as sc_log_config->log_level
@@ -98,77 +94,6 @@ int sc_log_module_initialized = 0;
 int sc_log_module_cleaned = 0;
 
 /**
- * \brief Maps the SC logging level to the syslog logging level
- *
- * \param The SC logging level that has to be mapped to the syslog_log_level
- *
- * \retval syslog_log_level The mapped syslog_api_log_level, for the logging
- *                          module api's internal log_level
- */
-static inline int SCLogMapLogLevelToSyslogLevel(int log_level)
-{
-    int syslog_log_level = 0;
-
-    switch (log_level) {
-        case SC_LOG_EMERGENCY:
-            syslog_log_level = LOG_EMERG;
-        case SC_LOG_ALERT:
-            syslog_log_level = LOG_ALERT;
-        case SC_LOG_CRITICAL:
-            syslog_log_level = LOG_CRIT;
-        case SC_LOG_ERROR:
-            syslog_log_level = LOG_ERR;
-        case SC_LOG_WARNING:
-            syslog_log_level = LOG_WARNING;
-        case SC_LOG_NOTICE:
-            syslog_log_level = LOG_NOTICE;
-        case SC_LOG_INFO:
-            syslog_log_level = LOG_INFO;
-        case SC_LOG_DEBUG:
-            syslog_log_level = LOG_DEBUG;
-        default:
-            syslog_log_level = LOG_EMERG;
-    }
-
-    return syslog_log_level;
-}
-
-/**
- * \brief Output function that logs a character string out to a file descriptor
- *
- * \param fd  Pointer to the file descriptor
- * \param msg Pointer to the character string that should be logged
- */
-static inline void SCLogPrintToStream(FILE *fd, char *msg)
-{
-    if (fprintf(fd, "%s", msg) < 0)
-        printf("Error writing to stream using fprintf\n");
-
-    fflush(fd);
-    return;
-}
-
-/**
- * \brief Output function that logs a character string throught the syslog iface
- *
- * \param syslog_log_level Holds the syslog_log_level that the message should be
- *                         logged as
- * \param msg              Pointer to the char string, that should be logged
- *
- * \todo syslog is thread-safe according to POSIX manual and glibc code, but we
- *       we will have to look into non POSIX compliant boxes like freeBSD
- */
-static inline void SCLogPrintToSyslog(int syslog_log_level, const char *msg)
-{
-    //static struct syslog_data data = SYSLOG_DATA_INIT;
-    //syslog_r(syslog_log_level, NULL, "%s", msg);
-
-    syslog(syslog_log_level, "%s", msg);
-
-    return;
-}
-
-/**
  * \brief Outputs the message sent as the argument
  *
  * \param msg       Pointer to the message that has to be logged
@@ -468,365 +393,6 @@ SCLogOPBuffer *SCLogAllocLogOPBuffer(void)
 /*----------------------The logging module initialization code--------------- */
 
 /**
- * \brief Returns a new output_interface_context
- *
- * \retval iface_ctx Pointer to a newly allocated output_interface_context
- */
-static inline SCLogOPIfaceCtx *SCLogAllocLogOPIfaceCtx()
-{
-    SCLogOPIfaceCtx *iface_ctx = NULL;
-
-    if ( (iface_ctx = malloc(sizeof(SCLogOPIfaceCtx))) == NULL) {
-        printf("Error allocating memory\n");
-        exit(EXIT_FAILURE);
-    }
-    memset(iface_ctx, 0, sizeof(SCLogOPIfaceCtx));
-
-    return iface_ctx;
-}
-
-/**
- * \brief Initializes the file output interface
- *
- * \param file       Path to the file used for logging purposes
- * \param log_format Pointer to the log_format for this op interface, that
- *                   overrides the global_log_format
- * \param log_level  Override of the global_log_level by this interface
- *
- * \retval iface_ctx Pointer to the file output interface context created
- */
-static inline SCLogOPIfaceCtx *SCLogInitFileOPIface(const char *file,
-                                                    const char *log_format,
-                                                    int log_level)
-{
-    SCLogOPIfaceCtx *iface_ctx = SCLogAllocLogOPIfaceCtx();
-
-    iface_ctx->iface = SC_LOG_OP_IFACE_FILE;
-
-    if (file != NULL &&
-        (iface_ctx->file = strdup(file)) == NULL) {
-        printf("Error allocating memory\n");
-        exit(EXIT_FAILURE);
-    }
-
-    if ( (iface_ctx->file_d = fopen(file, "w+")) == NULL) {
-        printf("Error opening file %s\n", file);
-        return NULL;
-    }
-
-    if (log_format != NULL &&
-        (iface_ctx->log_format = strdup(log_format)) == NULL) {
-        printf("Error allocating memory\n");
-        exit(EXIT_FAILURE);
-    }
-
-    iface_ctx->log_level = log_level;
-
-    return iface_ctx;
-}
-
-/**
- * \brief Initializes the console output interface
- *
- * \param log_format Pointer to the log_format for this op interface, that
- *                   overrides the global_log_format
- * \param log_level  Override of the global_log_level by this interface
- *
- * \retval iface_ctx Pointer to the console output interface context created
- */
-static inline SCLogOPIfaceCtx *SCLogInitConsoleOPIface(const char *log_format,
-                                                       SCLogLevel log_level)
-{
-    SCLogOPIfaceCtx *iface_ctx = SCLogAllocLogOPIfaceCtx();
-
-    if ( (iface_ctx = malloc(sizeof(SCLogOPIfaceCtx))) == NULL) {
-        printf("Error allocating memory\n");
-        exit(EXIT_FAILURE);
-    }
-    memset(iface_ctx, 0, sizeof(SCLogOPIfaceCtx));
-
-    iface_ctx->iface = SC_LOG_OP_IFACE_CONSOLE;
-
-    if (log_format != NULL &&
-        (iface_ctx->log_format = strdup(log_format)) == NULL) {
-        printf("Error allocating memory\n");
-        exit(EXIT_FAILURE);
-    }
-
-    iface_ctx->log_level = log_level;
-
-    return iface_ctx;
-}
-
-/**
- * \brief Initializes the syslog output interface
- *
- * \param facility   The facility code for syslog
- * \param log_format Pointer to the log_format for this op interface, that
- *                   overrides the global_log_format
- * \param log_level  Override of the global_log_level by this interface
- *
- * \retval iface_ctx Pointer to the syslog output interface context created
- */
-static inline SCLogOPIfaceCtx *SCLogInitSyslogOPIface(int facility,
-                                                      const char *log_format,
-                                                      SCLogLevel log_level)
-{
-    SCLogOPIfaceCtx *iface_ctx = SCLogAllocLogOPIfaceCtx();
-
-    if ( (iface_ctx = malloc(sizeof(SCLogOPIfaceCtx))) == NULL) {
-        printf("Error allocating memory\n");
-        exit(EXIT_FAILURE);
-    }
-    memset(iface_ctx, 0, sizeof(SCLogOPIfaceCtx));
-
-    iface_ctx->iface = SC_LOG_OP_IFACE_SYSLOG;
-
-    if (facility == -1)
-        facility = SC_LOG_DEF_SYSLOG_FACILITY;
-    iface_ctx->facility = facility;
-
-    if (log_format != NULL &&
-        (iface_ctx->log_format = strdup(log_format)) == NULL) {
-        printf("Error allocating memory\n");
-        exit(EXIT_FAILURE);
-    }
-
-    iface_ctx->log_level = log_level;
-
-    openlog(NULL, LOG_NDELAY, iface_ctx->facility);
-
-    return iface_ctx;
-}
-
-/**
- * \brief Frees the output_interface context supplied as an argument
- *
- * \param iface_ctx Pointer to the op_interface_context to be freed
- */
-static inline void SCLogFreeLogOPIfaceCtx(SCLogOPIfaceCtx *iface_ctx)
-{
-    SCLogOPIfaceCtx *temp = NULL;
-
-    while (iface_ctx != NULL) {
-        temp = iface_ctx;
-
-        if (iface_ctx->file_d != NULL)
-            fclose(iface_ctx->file_d);
-
-        if (iface_ctx->file != NULL)
-            free((void *)iface_ctx->file);
-
-        if (iface_ctx->log_format != NULL)
-            free((void *)iface_ctx->log_format);
-
-        if (iface_ctx->iface == SC_LOG_OP_IFACE_SYSLOG) {
-            closelog();
-        }
-
-        iface_ctx = iface_ctx->next;
-
-        free(temp);
-    }
-
-    return;
-}
-
-/**
- * \brief Internal function used to set the logging module global_log_level
- *        during the initialization phase
- *
- * \param sc_lid The initialization data supplied.
- * \param sc_lc  The logging module context which has to be updated.
- */
-static inline void SCLogSetLogLevel(SCLogInitData *sc_lid, SCLogConfig *sc_lc)
-{
-    SCLogLevel log_level = SC_LOG_NOTSET;
-    const char *s = NULL;
-
-    if (sc_lid != NULL)
-        log_level = sc_lid->global_log_level;
-    else {
-        s = getenv(SC_LOG_ENV_LOG_LEVEL);
-        if (s != NULL)
-            log_level = SCMapEnumNameToValue(s, sc_log_level_map);
-    }
-
-    /* deal with the global_log_level to be used */
-    if (log_level > SC_LOG_NOTSET && log_level < SC_LOG_LEVEL_MAX)
-        sc_lc->log_level = log_level;
-    else {
-        sc_lc->log_level = SC_LOG_DEF_LOG_LEVEL;
-#ifndef UNITTESTS
-        printf("Warning: Invalid global_log_level assigned by user.  Falling "
-               "back on the default_log_level \"%s\"\n",
-               SCMapEnumValueToName(sc_lc->log_level, sc_log_level_map));
-#endif
-    }
-
-    /* we also set it to a global var, as it is easier to access it */
-    sc_log_global_log_level = sc_lc->log_level;
-
-#ifdef DEBUG
-    printf("sc_log_global_log_level: %d\n", sc_log_global_log_level);
-#endif
-
-    return;
-}
-
-/**
- * \brief Internal function used to set the logging module global_log_format
- *        during the initialization phase
- *
- * \param sc_lid The initialization data supplied.
- * \param sc_lc  The logging module context which has to be updated.
- */
-static inline void SCLogSetLogFormat(SCLogInitData *sc_lid, SCLogConfig *sc_lc)
-{
-    char *format = NULL;
-
-    if (sc_lid != NULL)
-        format = sc_lid->global_log_format;
-    else
-        format = getenv(SC_LOG_ENV_LOG_FORMAT);
-
-    /* deal with the global log format to be used */
-    if (format == NULL || strlen(format) > SC_LOG_MAX_LOG_FORMAT_LEN) {
-        format = SC_LOG_DEF_LOG_FORMAT;
-#ifndef UNITTESTS
-        printf("Warning: Invalid global_log_format supplied by user or format "
-               "length exceeded limit of \"%d\" characters.  Falling back on "
-               "default log_format \"%s\"\n", SC_LOG_MAX_LOG_FORMAT_LEN,
-               format);
-#endif
-    }
-
-    if (format != NULL &&
-        (sc_lc->log_format = strdup(format)) == NULL) {
-        printf("Error allocating memory\n");
-        exit(EXIT_FAILURE);
-    }
-
-#ifdef DEBUG
-    printf("sc_lc->log_format: %s\n", sc_lc->log_format);
-#endif
-
-    return;
-}
-
-/**
- * \brief Internal function used to set the logging module global_op_ifaces
- *        during the initialization phase
- *
- * \param sc_lid The initialization data supplied.
- * \param sc_lc  The logging module context which has to be updated.
- */
-static inline void SCLogSetOPIface(SCLogInitData *sc_lid, SCLogConfig *sc_lc)
-{
-    SCLogOPIfaceCtx *op_ifaces_ctx = NULL;
-    int op_iface = 0;
-    const char *s = NULL;
-
-    if (sc_lid != NULL && sc_lid->op_ifaces != NULL) {
-        sc_lc->op_ifaces = sc_lid->op_ifaces;
-        sc_lid->op_ifaces = NULL;
-        sc_lc->op_ifaces_cnt = sc_lid->op_ifaces_cnt;
-    }
-    else {
-        s = getenv(SC_LOG_ENV_LOG_OP_IFACE);
-        if (s != NULL) {
-            op_iface = SCMapEnumNameToValue(s, sc_log_op_iface_map);
-
-            if(op_iface < 0 || op_iface >= SC_LOG_OP_IFACE_MAX) {
-                op_iface = SC_LOG_DEF_LOG_OP_IFACE;
-#ifndef UNITTESTS
-                printf("Warning: Invalid output interface supplied by user.  "
-                       "Falling back on default_output_interface \"%s\"\n",
-                       SCMapEnumValueToName(op_iface, sc_log_op_iface_map));
-#endif
-            }
-        }
-        else {
-            op_iface = SC_LOG_DEF_LOG_OP_IFACE;
-#ifndef UNITTESTS
-            printf("Warning: Output_interface not supplied by user.  Falling "
-                   "back on default_output_interface \"%s\"\n",
-                   SCMapEnumValueToName(op_iface, sc_log_op_iface_map));
-#endif
-        }
-
-        switch (op_iface) {
-            case SC_LOG_OP_IFACE_CONSOLE:
-                op_ifaces_ctx = SCLogInitConsoleOPIface(NULL, SC_LOG_LEVEL_MAX);
-                break;
-            case SC_LOG_OP_IFACE_FILE:
-                s = getenv(SC_LOG_ENV_LOG_FILE);
-                if (s == NULL)
-                    s = SCLogGetLogFilename(SC_LOG_DEF_LOG_FILE);
-
-                op_ifaces_ctx = SCLogInitFileOPIface(s, NULL, SC_LOG_LEVEL_MAX);
-                break;
-            case SC_LOG_OP_IFACE_SYSLOG:
-                s = getenv(SC_LOG_ENV_LOG_FACILITY);
-                if (s == NULL)
-                    s = SC_LOG_DEF_SYSLOG_FACILITY_STR;
-
-                op_ifaces_ctx = SCLogInitSyslogOPIface(SCMapEnumNameToValue(s, sc_syslog_facility_map), NULL, -1);
-                break;
-            default:
-                break;
-        }
-        sc_lc->op_ifaces = op_ifaces_ctx;
-        sc_lc->op_ifaces_cnt++;
-    }
-
-    return;
-}
-
-/**
- * \brief Internal function used to set the logging module op_filter
- *        during the initialization phase
- *
- * \param sc_lid The initialization data supplied.
- * \param sc_lc  The logging module context which has to be updated.
- */
-static inline void SCLogSetOPFilter(SCLogInitData *sc_lid, SCLogConfig *sc_lc)
-{
-    const char *filter = NULL;
-
-    int opts = 0;
-    const char *ep;
-    int eo = 0;
-
-    if (sc_lid != NULL)
-        filter = sc_lid->op_filter;
-    else
-        filter = getenv(SC_LOG_ENV_LOG_OP_FILTER);
-
-    if (filter != NULL && strcmp(filter, "") != 0) {
-        sc_lc->op_filter_regex = pcre_compile(filter, opts, &ep, &eo, NULL);
-        if (sc_lc->op_filter_regex == NULL) {
-            printf("pcre compile of \"%s\" failed at offset %d : %s\n", filter,
-                   eo, ep);
-            return;
-        }
-
-        sc_lc->op_filter_regex_study = pcre_study(sc_lc->op_filter_regex, 0,
-                                                  &ep);
-        if (ep != NULL) {
-            printf("pcre study failed: %s\n", ep);
-            return;
-        }
-    }
-
-#ifdef DEBUG
-    printf("SCLogSetOPFilter: filter: %s\n", filter ? filter : "<no filter>");
-#endif
-
-    return;
-}
-
-/**
  * \brief Returns a pointer to a new SCLogInitData.  This is a public interface
  *        intended to be used after the logging paramters are read from the
  *        conf file
@@ -868,24 +434,6 @@ void SCLogFreeLogInitData(SCLogInitData *sc_lid)
 }
 
 /**
- * \brief Frees the logging module context
- */
-static inline void SCLogFreeLogConfig(SCLogConfig *sc_lc)
-{
-    if (sc_lc != NULL) {
-        if (sc_lc->startup_message != NULL)
-            free(sc_lc->startup_message);
-        if (sc_lc->log_format != NULL)
-            free(sc_lc->log_format);
-
-        SCLogFreeLogOPIfaceCtx(sc_lc->op_ifaces);
-        free(sc_lc);
-    }
-
-    return;
-}
-
-/**
  * \brief Appends an output_interface to the output_interface list sent in head
  *
  * \param iface_ctx Pointer to the output_interface that has to be added to head
@@ -1240,7 +788,7 @@ void SCLogInitLogModuleIfEnvSet(void)
  *
  * \retval log_filename The fullpath of the logfile to open
  */
-static char *SCLogGetLogFilename(char *filearg)
+char *SCLogGetLogFilename(char *filearg)
 {
     char *log_dir;
     char *log_filename;
diff --git a/src/util-debug.h b/src/util-debug.h
index 18cb93b..959dc2a 100644
--- a/src/util-debug.h
+++ b/src/util-debug.h
@@ -2,7 +2,10 @@
  *  \author Anoop Saldanha <poonaatsoc@gmail.com>
  */
 
-#include <stdio.h>
+#ifndef __UTIL_DEBUG_H__
+#define __UTIL_DEBUG_H__
+
+#include "suricata-common.h"
 #include "threads.h"
 #include <stdint.h>
 
@@ -11,8 +14,14 @@
 #include "pcre.h"
 #include "util-debug-filters.h"
 
-#ifndef __UTIL_DEBUG_H__
-#define __UTIL_DEBUG_H__
+extern SCEnumCharMap sc_log_level_map[11];
+extern SCEnumCharMap sc_log_op_iface_map[4];
+extern SCEnumCharMap sc_syslog_facility_map[22];
+
+/**
+ * \brief Returns the full path given a file and configured log dir
+ */
+char *SCLogGetLogFilename(char *);
 
 /**
  * \brief ENV vars that can be used to set the properties for the logging module
@@ -73,6 +82,7 @@ typedef enum {
 #define SC_LOG_DEF_SYSLOG_FACILITY_STR "local0"
 #define SC_LOG_DEF_SYSLOG_FACILITY LOG_LOCAL0
 
+
 /**
  * \brief Structure to be used when log_level override support would be provided
  *        by the logging module
@@ -520,4 +530,473 @@ void SCLogRegisterTests(void);
 
 void SCLogLoadConfig(void);
 
+/** --------- Inline functions -------- */
+
+#if 0
+static inline void SCLogFreeLogConfig(SCLogConfig *);
+static inline SCLogOPIfaceCtx *SCLogAllocLogOPIfaceCtx();
+static inline SCLogOPIfaceCtx *SCLogInitFileOPIface(const char *, const char *, int );
+static inline SCLogOPIfaceCtx *SCLogInitConsoleOPIface(const char *, SCLogLevel );
+static inline SCLogOPIfaceCtx *SCLogInitSyslogOPIface(int, const char *, SCLogLevel );
+static inline void SCLogFreeLogOPIfaceCtx(SCLogOPIfaceCtx *);
+static inline void SCLogSetLogLevel(SCLogInitData *, SCLogConfig *);
+static inline void SCLogSetLogFormat(SCLogInitData *, SCLogConfig *);
+static inline void SCLogSetOPIface(SCLogInitData *, SCLogConfig *);
+static inline void SCLogSetOPFilter(SCLogInitData *, SCLogConfig *);
+static inline int SCLogMapLogLevelToSyslogLevel(int );
+static inline void SCLogPrintToStream(FILE *, char *);
+static inline void SCLogPrintToSyslog(int , const char *);
+#endif
+
+/**
+ * \brief Frees the output_interface context supplied as an argument
+ *
+ * \param iface_ctx Pointer to the op_interface_context to be freed
+ */
+static inline void SCLogFreeLogOPIfaceCtx(SCLogOPIfaceCtx *iface_ctx)
+{
+    SCLogOPIfaceCtx *temp = NULL;
+
+    while (iface_ctx != NULL) {
+        temp = iface_ctx;
+
+        if (iface_ctx->file_d != NULL)
+            fclose(iface_ctx->file_d);
+
+        if (iface_ctx->file != NULL)
+            free((void *)iface_ctx->file);
+
+        if (iface_ctx->log_format != NULL)
+            free((void *)iface_ctx->log_format);
+
+        if (iface_ctx->iface == SC_LOG_OP_IFACE_SYSLOG) {
+            closelog();
+        }
+
+        iface_ctx = iface_ctx->next;
+
+        free(temp);
+    }
+
+    return;
+}
+
+
+/**
+ * \brief Frees the logging module context
+ */
+static inline void SCLogFreeLogConfig(SCLogConfig *sc_lc)
+{
+    if (sc_lc != NULL) {
+        if (sc_lc->startup_message != NULL)
+            free(sc_lc->startup_message);
+        if (sc_lc->log_format != NULL)
+            free(sc_lc->log_format);
+
+        SCLogFreeLogOPIfaceCtx(sc_lc->op_ifaces);
+        free(sc_lc);
+    }
+
+    return;
+}
+
+/**
+ * \brief Returns a new output_interface_context
+ *
+ * \retval iface_ctx Pointer to a newly allocated output_interface_context
+ */
+static inline SCLogOPIfaceCtx *SCLogAllocLogOPIfaceCtx()
+{
+    SCLogOPIfaceCtx *iface_ctx = NULL;
+
+    if ( (iface_ctx = malloc(sizeof(SCLogOPIfaceCtx))) == NULL) {
+        printf("Error allocating memory\n");
+        exit(EXIT_FAILURE);
+    }
+    memset(iface_ctx, 0, sizeof(SCLogOPIfaceCtx));
+
+    return iface_ctx;
+}
+
+/**
+ * \brief Initializes the file output interface
+ *
+ * \param file       Path to the file used for logging purposes
+ * \param log_format Pointer to the log_format for this op interface, that
+ *                   overrides the global_log_format
+ * \param log_level  Override of the global_log_level by this interface
+ *
+ * \retval iface_ctx Pointer to the file output interface context created
+ */
+static inline SCLogOPIfaceCtx *SCLogInitFileOPIface(const char *file,
+                                                    const char *log_format,
+                                                    int log_level)
+{
+    SCLogOPIfaceCtx *iface_ctx = SCLogAllocLogOPIfaceCtx();
+
+    iface_ctx->iface = SC_LOG_OP_IFACE_FILE;
+
+    if (file != NULL &&
+        (iface_ctx->file = strdup(file)) == NULL) {
+        printf("Error allocating memory\n");
+        exit(EXIT_FAILURE);
+    }
+
+    if ( (iface_ctx->file_d = fopen(file, "w+")) == NULL) {
+        printf("Error opening file %s\n", file);
+        return NULL;
+    }
+
+    if (log_format != NULL &&
+        (iface_ctx->log_format = strdup(log_format)) == NULL) {
+        printf("Error allocating memory\n");
+        exit(EXIT_FAILURE);
+    }
+
+    iface_ctx->log_level = log_level;
+
+    return iface_ctx;
+}
+
+/**
+ * \brief Initializes the console output interface
+ *
+ * \param log_format Pointer to the log_format for this op interface, that
+ *                   overrides the global_log_format
+ * \param log_level  Override of the global_log_level by this interface
+ *
+ * \retval iface_ctx Pointer to the console output interface context created
+ */
+static inline SCLogOPIfaceCtx *SCLogInitConsoleOPIface(const char *log_format,
+                                                       SCLogLevel log_level)
+{
+    SCLogOPIfaceCtx *iface_ctx = SCLogAllocLogOPIfaceCtx();
+
+    if ( (iface_ctx = malloc(sizeof(SCLogOPIfaceCtx))) == NULL) {
+        printf("Error allocating memory\n");
+        exit(EXIT_FAILURE);
+    }
+    memset(iface_ctx, 0, sizeof(SCLogOPIfaceCtx));
+
+    iface_ctx->iface = SC_LOG_OP_IFACE_CONSOLE;
+
+    if (log_format != NULL &&
+        (iface_ctx->log_format = strdup(log_format)) == NULL) {
+        printf("Error allocating memory\n");
+        exit(EXIT_FAILURE);
+    }
+
+    iface_ctx->log_level = log_level;
+
+    return iface_ctx;
+}
+
+/**
+ * \brief Initializes the syslog output interface
+ *
+ * \param facility   The facility code for syslog
+ * \param log_format Pointer to the log_format for this op interface, that
+ *                   overrides the global_log_format
+ * \param log_level  Override of the global_log_level by this interface
+ *
+ * \retval iface_ctx Pointer to the syslog output interface context created
+ */
+static inline SCLogOPIfaceCtx *SCLogInitSyslogOPIface(int facility,
+                                                      const char *log_format,
+                                                      SCLogLevel log_level)
+{
+    SCLogOPIfaceCtx *iface_ctx = SCLogAllocLogOPIfaceCtx();
+
+    if ( (iface_ctx = malloc(sizeof(SCLogOPIfaceCtx))) == NULL) {
+        printf("Error allocating memory\n");
+        exit(EXIT_FAILURE);
+    }
+    memset(iface_ctx, 0, sizeof(SCLogOPIfaceCtx));
+
+    iface_ctx->iface = SC_LOG_OP_IFACE_SYSLOG;
+
+    if (facility == -1)
+        facility = SC_LOG_DEF_SYSLOG_FACILITY;
+    iface_ctx->facility = facility;
+
+    if (log_format != NULL &&
+        (iface_ctx->log_format = strdup(log_format)) == NULL) {
+        printf("Error allocating memory\n");
+        exit(EXIT_FAILURE);
+    }
+
+    iface_ctx->log_level = log_level;
+
+    openlog(NULL, LOG_NDELAY, iface_ctx->facility);
+
+    return iface_ctx;
+}
+
+/**
+ * \brief Internal function used to set the logging module global_log_level
+ *        during the initialization phase
+ *
+ * \param sc_lid The initialization data supplied.
+ * \param sc_lc  The logging module context which has to be updated.
+ */
+static inline void SCLogSetLogLevel(SCLogInitData *sc_lid, SCLogConfig *sc_lc)
+{
+    SCLogLevel log_level = SC_LOG_NOTSET;
+    const char *s = NULL;
+
+    if (sc_lid != NULL)
+        log_level = sc_lid->global_log_level;
+    else {
+        s = getenv(SC_LOG_ENV_LOG_LEVEL);
+        if (s != NULL)
+            log_level = SCMapEnumNameToValue(s, sc_log_level_map);
+    }
+
+    /* deal with the global_log_level to be used */
+    if (log_level > SC_LOG_NOTSET && log_level < SC_LOG_LEVEL_MAX)
+        sc_lc->log_level = log_level;
+    else {
+        sc_lc->log_level = SC_LOG_DEF_LOG_LEVEL;
+#ifndef UNITTESTS
+        printf("Warning: Invalid global_log_level assigned by user.  Falling "
+               "back on the default_log_level \"%s\"\n",
+               SCMapEnumValueToName(sc_lc->log_level, sc_log_level_map));
+#endif
+    }
+
+    /* we also set it to a global var, as it is easier to access it */
+    sc_log_global_log_level = sc_lc->log_level;
+
+#ifdef DEBUG
+    printf("sc_log_global_log_level: %d\n", sc_log_global_log_level);
+#endif
+
+    return;
+}
+
+/**
+ * \brief Internal function used to set the logging module global_log_format
+ *        during the initialization phase
+ *
+ * \param sc_lid The initialization data supplied.
+ * \param sc_lc  The logging module context which has to be updated.
+ */
+static inline void SCLogSetLogFormat(SCLogInitData *sc_lid, SCLogConfig *sc_lc)
+{
+    char *format = NULL;
+
+    if (sc_lid != NULL)
+        format = sc_lid->global_log_format;
+    else
+        format = getenv(SC_LOG_ENV_LOG_FORMAT);
+
+    /* deal with the global log format to be used */
+    if (format == NULL || strlen(format) > SC_LOG_MAX_LOG_FORMAT_LEN) {
+        format = SC_LOG_DEF_LOG_FORMAT;
+#ifndef UNITTESTS
+        printf("Warning: Invalid global_log_format supplied by user or format "
+               "length exceeded limit of \"%d\" characters.  Falling back on "
+               "default log_format \"%s\"\n", SC_LOG_MAX_LOG_FORMAT_LEN,
+               format);
+#endif
+    }
+
+    if (format != NULL &&
+        (sc_lc->log_format = strdup(format)) == NULL) {
+        printf("Error allocating memory\n");
+        exit(EXIT_FAILURE);
+    }
+
+#ifdef DEBUG
+    printf("sc_lc->log_format: %s\n", sc_lc->log_format);
+#endif
+
+    return;
+}
+
+/**
+ * \brief Internal function used to set the logging module global_op_ifaces
+ *        during the initialization phase
+ *
+ * \param sc_lid The initialization data supplied.
+ * \param sc_lc  The logging module context which has to be updated.
+ */
+static inline void SCLogSetOPIface(SCLogInitData *sc_lid, SCLogConfig *sc_lc)
+{
+    SCLogOPIfaceCtx *op_ifaces_ctx = NULL;
+    int op_iface = 0;
+    const char *s = NULL;
+
+    if (sc_lid != NULL && sc_lid->op_ifaces != NULL) {
+        sc_lc->op_ifaces = sc_lid->op_ifaces;
+        sc_lid->op_ifaces = NULL;
+        sc_lc->op_ifaces_cnt = sc_lid->op_ifaces_cnt;
+    }
+    else {
+        s = getenv(SC_LOG_ENV_LOG_OP_IFACE);
+        if (s != NULL) {
+            op_iface = SCMapEnumNameToValue(s, sc_log_op_iface_map);
+
+            if(op_iface < 0 || op_iface >= SC_LOG_OP_IFACE_MAX) {
+                op_iface = SC_LOG_DEF_LOG_OP_IFACE;
+#ifndef UNITTESTS
+                printf("Warning: Invalid output interface supplied by user.  "
+                       "Falling back on default_output_interface \"%s\"\n",
+                       SCMapEnumValueToName(op_iface, sc_log_op_iface_map));
+#endif
+            }
+        }
+        else {
+            op_iface = SC_LOG_DEF_LOG_OP_IFACE;
+#ifndef UNITTESTS
+            printf("Warning: Output_interface not supplied by user.  Falling "
+                   "back on default_output_interface \"%s\"\n",
+                   SCMapEnumValueToName(op_iface, sc_log_op_iface_map));
+#endif
+        }
+
+        switch (op_iface) {
+            case SC_LOG_OP_IFACE_CONSOLE:
+                op_ifaces_ctx = SCLogInitConsoleOPIface(NULL, SC_LOG_LEVEL_MAX);
+                break;
+            case SC_LOG_OP_IFACE_FILE:
+                s = getenv(SC_LOG_ENV_LOG_FILE);
+                if (s == NULL)
+                    s = SCLogGetLogFilename(SC_LOG_DEF_LOG_FILE);
+
+                op_ifaces_ctx = SCLogInitFileOPIface(s, NULL, SC_LOG_LEVEL_MAX);
+                break;
+            case SC_LOG_OP_IFACE_SYSLOG:
+                s = getenv(SC_LOG_ENV_LOG_FACILITY);
+                if (s == NULL)
+                    s = SC_LOG_DEF_SYSLOG_FACILITY_STR;
+
+                op_ifaces_ctx = SCLogInitSyslogOPIface(SCMapEnumNameToValue(s, sc_syslog_facility_map), NULL, -1);
+                break;
+            default:
+                break;
+        }
+        sc_lc->op_ifaces = op_ifaces_ctx;
+        sc_lc->op_ifaces_cnt++;
+    }
+
+    return;
+}
+
+/**
+ * \brief Internal function used to set the logging module op_filter
+ *        during the initialization phase
+ *
+ * \param sc_lid The initialization data supplied.
+ * \param sc_lc  The logging module context which has to be updated.
+ */
+static inline void SCLogSetOPFilter(SCLogInitData *sc_lid, SCLogConfig *sc_lc)
+{
+    const char *filter = NULL;
+
+    int opts = 0;
+    const char *ep;
+    int eo = 0;
+
+    if (sc_lid != NULL)
+        filter = sc_lid->op_filter;
+    else
+        filter = getenv(SC_LOG_ENV_LOG_OP_FILTER);
+
+    if (filter != NULL && strcmp(filter, "") != 0) {
+        sc_lc->op_filter_regex = pcre_compile(filter, opts, &ep, &eo, NULL);
+        if (sc_lc->op_filter_regex == NULL) {
+            printf("pcre compile of \"%s\" failed at offset %d : %s\n", filter,
+                   eo, ep);
+            return;
+        }
+
+        sc_lc->op_filter_regex_study = pcre_study(sc_lc->op_filter_regex, 0,
+                                                  &ep);
+        if (ep != NULL) {
+            printf("pcre study failed: %s\n", ep);
+            return;
+        }
+    }
+
+#ifdef DEBUG
+    printf("SCLogSetOPFilter: filter: %s\n", filter ? filter : "<no filter>");
+#endif
+
+    return;
+}
+
+
+/**
+ * \brief Maps the SC logging level to the syslog logging level
+ *
+ * \param The SC logging level that has to be mapped to the syslog_log_level
+ *
+ * \retval syslog_log_level The mapped syslog_api_log_level, for the logging
+ *                          module api's internal log_level
+ */
+static inline int SCLogMapLogLevelToSyslogLevel(int log_level)
+{
+    int syslog_log_level = 0;
+
+    switch (log_level) {
+        case SC_LOG_EMERGENCY:
+            syslog_log_level = LOG_EMERG;
+        case SC_LOG_ALERT:
+            syslog_log_level = LOG_ALERT;
+        case SC_LOG_CRITICAL:
+            syslog_log_level = LOG_CRIT;
+        case SC_LOG_ERROR:
+            syslog_log_level = LOG_ERR;
+        case SC_LOG_WARNING:
+            syslog_log_level = LOG_WARNING;
+        case SC_LOG_NOTICE:
+            syslog_log_level = LOG_NOTICE;
+        case SC_LOG_INFO:
+            syslog_log_level = LOG_INFO;
+        case SC_LOG_DEBUG:
+            syslog_log_level = LOG_DEBUG;
+        default:
+            syslog_log_level = LOG_EMERG;
+    }
+
+    return syslog_log_level;
+}
+
+/**
+ * \brief Output function that logs a character string out to a file descriptor
+ *
+ * \param fd  Pointer to the file descriptor
+ * \param msg Pointer to the character string that should be logged
+ */
+static inline void SCLogPrintToStream(FILE *fd, char *msg)
+{
+    if (fprintf(fd, "%s", msg) < 0)
+        printf("Error writing to stream using fprintf\n");
+
+    fflush(fd);
+    return;
+}
+
+/**
+ * \brief Output function that logs a character string throught the syslog iface
+ *
+ * \param syslog_log_level Holds the syslog_log_level that the message should be
+ *                         logged as
+ * \param msg              Pointer to the char string, that should be logged
+ *
+ * \todo syslog is thread-safe according to POSIX manual and glibc code, but we
+ *       we will have to look into non POSIX compliant boxes like freeBSD
+ */
+static inline void SCLogPrintToSyslog(int syslog_log_level, const char *msg)
+{
+    //static struct syslog_data data = SYSLOG_DATA_INIT;
+    //syslog_r(syslog_log_level, NULL, "%s", msg);
+
+    syslog(syslog_log_level, "%s", msg);
+
+    return;
+}
+
+
 #endif /* __UTIL_DEBUG_H__ */
diff --git a/src/util-mpm-b2g-cuda.c b/src/util-mpm-b2g-cuda.c
index ff8dc3a..b70a147 100644
--- a/src/util-mpm-b2g-cuda.c
+++ b/src/util-mpm-b2g-cuda.c
@@ -74,12 +74,6 @@ int B2gCudaAddPatternCS(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen,
                         uint16_t offset, uint16_t depth, uint32_t pid,
                         uint32_t sid);
 int B2gCudaPreparePatterns(MpmCtx *mpm_ctx);
-inline uint32_t B2gCudaScanWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx,
-                                PatternMatcherQueue *, uint8_t *buf,
-                                uint16_t buflen);
-inline uint32_t B2gCudaSearchWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx,
-                                  PatternMatcherQueue *, uint8_t *buf,
-                                  uint16_t buflen);
 uint32_t B2gCudaScan1(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx,
                       PatternMatcherQueue *, uint8_t *buf, uint16_t buflen);
 
@@ -484,48 +478,6 @@ void MpmB2gCudaRegister(void)
     mpm_table[MPM_B2G_CUDA].RegisterUnittests = B2gCudaRegisterTests;
 }
 
-static inline void B2gCudaEndMatchAppend(MpmCtx *mpm_ctx, B2gCudaPattern *p,
-                                         uint16_t offset, uint16_t depth,
-                                         uint32_t pid, uint32_t sid,
-                                         uint8_t nosearch)
-{
-    MpmEndMatch *em = MpmAllocEndMatch(mpm_ctx);
-    if (em == NULL) {
-        SCLogDebug("ERROR: B2gAllocEndMatch failed");
-        return;
-    }
-
-    SCLogDebug("em alloced at %p", em);
-
-    em->id = pid;
-    em->sig_id = sid;
-    em->depth = depth;
-    em->offset = offset;
-
-    if (nosearch)
-        em->flags |= MPM_ENDMATCH_NOSEARCH;
-
-    if (p->em == NULL) {
-        p->em = em;
-        SCLogDebug("m %p m->sig_id %"PRIu32"", em, em->sig_id);
-        return;
-    }
-
-    MpmEndMatch *m = p->em;
-    while (m->next)
-        m = m->next;
-    m->next = em;
-
-    m = p->em;
-    SCLogDebug("m %p m->sig_id %" PRIu32, m, m->sig_id);
-    while (m->next) {
-        m = m->next;
-        SCLogDebug("m %p m->sig_id %" PRIu32, m, m->sig_id);
-    }
-
-    return;
-}
-
 void B2gCudaPrintInfo(MpmCtx *mpm_ctx)
 {
     B2gCudaCtx *ctx = (B2gCudaCtx *)mpm_ctx->ctx;
@@ -548,36 +500,6 @@ void B2gCudaPrintInfo(MpmCtx *mpm_ctx)
     return;
 }
 
-static inline B2gCudaPattern *B2gCudaAllocPattern(MpmCtx *mpm_ctx)
-{
-    B2gCudaPattern *p = SCMalloc(sizeof(B2gCudaPattern));
-    if (p == NULL) {
-        printf("ERROR: B2gAllocPattern: malloc failed\n");
-        exit(EXIT_FAILURE);
-    }
-    memset(p, 0, sizeof(B2gCudaPattern));
-
-    mpm_ctx->memory_cnt++;
-    mpm_ctx->memory_size += sizeof(B2gCudaPattern);
-
-    return p;
-}
-
-static inline B2gCudaHashItem *B2gCudaAllocHashItem(MpmCtx *mpm_ctx)
-{
-    B2gCudaHashItem *hi = SCMalloc(sizeof(B2gCudaHashItem));
-    if (hi == NULL) {
-        printf("ERROR: B2gCudaAllocHashItem: malloc failed\n");
-        exit(EXIT_FAILURE);
-    }
-    memset(hi, 0, sizeof(B2gCudaHashItem));
-
-    mpm_ctx->memory_cnt++;
-    mpm_ctx->memory_size += sizeof(B2gCudaHashItem);
-
-    return hi;
-}
-
 static void B2gCudaHashFree(MpmCtx *mpm_ctx, B2gCudaHashItem *hi)
 {
     if (hi == NULL)
@@ -593,93 +515,6 @@ static void B2gCudaHashFree(MpmCtx *mpm_ctx, B2gCudaHashItem *hi)
     return;
 }
 
-static inline void memcpy_tolower(uint8_t *d, uint8_t *s, uint16_t len)
-{
-    uint16_t i;
-    for (i = 0; i < len; i++)
-        d[i] = u8_tolower(s[i]);
-
-    return;
-}
-
-static inline uint32_t B2gCudaInitHash(B2gCudaPattern *p)
-{
-    uint32_t hash = p->len * p->cs[0];
-    if (p->len > 1)
-        hash += p->cs[1];
-
-    return (hash % INIT_HASH_SIZE);
-}
-
-static inline uint32_t B2gCudaInitHashRaw(uint8_t *pat, uint16_t patlen)
-{
-    uint32_t hash = patlen * pat[0];
-    if (patlen > 1)
-        hash += pat[1];
-
-    return (hash % INIT_HASH_SIZE);
-}
-
-static inline int B2gCudaInitHashAdd(B2gCudaCtx *ctx, B2gCudaPattern *p)
-{
-    uint32_t hash = B2gCudaInitHash(p);
-
-    if (ctx->init_hash[hash] == NULL) {
-        ctx->init_hash[hash] = p;
-        return 0;
-    }
-
-    B2gCudaPattern *tt = NULL;
-    B2gCudaPattern *t = ctx->init_hash[hash];
-
-    /* get the list tail */
-    do {
-        tt = t;
-        t = t->next;
-    } while (t != NULL);
-
-    tt->next = p;
-
-    return 0;
-}
-
-static inline int B2gCudaCmpPattern(B2gCudaPattern *p, uint8_t *pat,
-                                    uint16_t patlen, char nocase);
-
-static inline B2gCudaPattern *B2gCudaInitHashLookup(B2gCudaCtx *ctx, uint8_t *pat,
-                                                    uint16_t patlen, char nocase)
-{
-    uint32_t hash = B2gCudaInitHashRaw(pat, patlen);
-
-    if (ctx->init_hash[hash] == NULL)
-        return NULL;
-
-    B2gCudaPattern *t = ctx->init_hash[hash];
-    for ( ; t != NULL; t = t->next) {
-        if (B2gCudaCmpPattern(t, pat, patlen, nocase) == 1)
-            return t;
-    }
-
-    return NULL;
-}
-
-static inline int B2gCudaCmpPattern(B2gCudaPattern *p, uint8_t *pat,
-                                    uint16_t patlen, char nocase)
-{
-    if (p->len != patlen)
-        return 0;
-
-    if (!((nocase && p->flags & B2G_CUDA_NOCASE) ||
-          (!nocase && !(p->flags & B2G_CUDA_NOCASE)))) {
-        return 0;
-    }
-
-    if (memcmp(p->cs, pat, patlen) != 0)
-        return 0;
-
-    return 1;
-}
-
 void B2gCudaFreePattern(MpmCtx *mpm_ctx, B2gCudaPattern *p)
 {
     if (p && p->em)
@@ -706,119 +541,6 @@ void B2gCudaFreePattern(MpmCtx *mpm_ctx, B2gCudaPattern *p)
     return;
 }
 
-static inline int B2gCudaAddPattern(MpmCtx *mpm_ctx, uint8_t *pat,
-                                    uint16_t patlen, uint16_t offset,
-                                    uint16_t depth, char nocase, char scan,
-                                    uint32_t pid, uint32_t sid,
-                                    uint8_t nosearch)
-{
-    B2gCudaCtx *ctx = (B2gCudaCtx *)mpm_ctx->ctx;
-
-    SCLogDebug("ctx %p len %"PRIu16" pid %" PRIu32 ", nocase %s",
-               ctx, patlen, pid, nocase ? "true" : "false");
-
-    if (patlen == 0)
-        return 0;
-
-    /* get a memory piece */
-    B2gCudaPattern *p = B2gCudaInitHashLookup(ctx, pat, patlen, nocase);
-    if (p == NULL) {
-        SCLogDebug("allocing new pattern");
-
-        p = B2gCudaAllocPattern(mpm_ctx);
-        if (p == NULL)
-            goto error;
-
-        p->len = patlen;
-
-        if (nocase)
-            p->flags |= B2G_CUDA_NOCASE;
-
-        /* setup the case insensitive part of the pattern */
-        p->ci = SCMalloc(patlen);
-        if (p->ci == NULL)
-            goto error;
-        mpm_ctx->memory_cnt++;
-        mpm_ctx->memory_size += patlen;
-        memcpy_tolower(p->ci, pat, patlen);
-
-        /* setup the case sensitive part of the pattern */
-        if (p->flags & B2G_CUDA_NOCASE) {
-            /* nocase means no difference between cs and ci */
-            p->cs = p->ci;
-        } else {
-            if (memcmp(p->ci,pat,p->len) == 0) {
-                /* no diff between cs and ci: pat is lowercase */
-                p->cs = p->ci;
-            } else {
-                p->cs = SCMalloc(patlen);
-                if (p->cs == NULL)
-                    goto error;
-                mpm_ctx->memory_cnt++;
-                mpm_ctx->memory_size += patlen;
-                memcpy(p->cs, pat, patlen);
-            }
-        }
-
-        /* put in the pattern hash */
-        B2gCudaInitHashAdd(ctx, p);
-
-        if (mpm_ctx->pattern_cnt == 65535) {
-            printf("Max search words reached\n");
-            exit(1);
-        }
-        if (scan)
-            mpm_ctx->scan_pattern_cnt++;
-        mpm_ctx->pattern_cnt++;
-
-        if (scan) { /* SCAN */
-            if (mpm_ctx->scan_maxlen < patlen)
-                mpm_ctx->scan_maxlen = patlen;
-
-            if (mpm_ctx->scan_minlen == 0)
-                mpm_ctx->scan_minlen = patlen;
-            else if (mpm_ctx->scan_minlen > patlen)
-                mpm_ctx->scan_minlen = patlen;
-
-            p->flags |= B2G_CUDA_SCAN;
-        } else { /* SEARCH */
-            if (mpm_ctx->search_maxlen < patlen)
-                mpm_ctx->search_maxlen = patlen;
-
-            if (mpm_ctx->search_minlen == 0)
-                mpm_ctx->search_minlen = patlen;
-            else if (mpm_ctx->search_minlen > patlen)
-                mpm_ctx->search_minlen = patlen;
-        }
-    } else {
-        /* if we're reusing a pattern, check we need to check that it is a
-         * scan pattern if that is what we're adding. If so we set the pattern
-         * to be a scan pattern. */
-        if (scan) {
-            p->flags |= B2G_CUDA_SCAN;
-
-            if (mpm_ctx->scan_maxlen < patlen)
-                mpm_ctx->scan_maxlen = patlen;
-
-            if (mpm_ctx->scan_minlen == 0)
-                mpm_ctx->scan_minlen = patlen;
-            else if (mpm_ctx->scan_minlen > patlen)
-                mpm_ctx->scan_minlen = patlen;
-        }
-    }
-
-    /* we need a match */
-    B2gCudaEndMatchAppend(mpm_ctx, p, offset, depth, pid, sid, nosearch);
-
-    mpm_ctx->total_pattern_cnt++;
-
-    return 0;
-
-error:
-    B2gCudaFreePattern(mpm_ctx, p);
-    return -1;
-}
-
 int B2gCudaAddScanPatternCI(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen,
                             uint16_t offset, uint16_t depth, uint32_t pid,
                             uint32_t sid, uint8_t nosearch)
@@ -851,23 +573,6 @@ int B2gCudaAddPatternCS(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen,
                              /* scan */0, pid, sid, 0);
 }
 
-static inline uint32_t B2gCudaBloomHash(void *data, uint16_t datalen, uint8_t iter,
-                                        uint32_t hash_size)
-{
-     uint8_t *d = (uint8_t *)data;
-     uint16_t i;
-     uint32_t hash = (uint32_t)u8_tolower(*d);
-
-     for (i = 1; i < datalen; i++) {
-         d++;
-         hash += (u8_tolower(*d)) ^ i;
-     }
-     hash <<= (iter+1);
-     hash %= hash_size;
-
-     return hash;
-}
-
 static void B2gCudaPrepareScanHash(MpmCtx *mpm_ctx)
 {
     B2gCudaCtx *ctx = (B2gCudaCtx *)mpm_ctx->ctx;
@@ -1411,21 +1116,6 @@ void B2gCudaPrintSearchStats(MpmThreadCtx *mpm_thread_ctx)
     return;
 }
 
-static inline int memcmp_lowercase(uint8_t *s1, uint8_t *s2, uint16_t n)
-{
-    size_t i;
-
-    /* check backwards because we already tested the first
-     * 2 to 4 chars. This way we are more likely to detect
-     * a miss and thus speed up a little... */
-    for (i = n - 1; i; i--) {
-        if (u8_tolower(*(s2+i)) != s1[i])
-            return 1;
-    }
-
-    return 0;
-}
-
 void B2gCudaInitCtx(MpmCtx *mpm_ctx, int module_handle)
 {
     SCLogDebug("mpm_ctx %p, ctx %p", mpm_ctx, mpm_ctx->ctx);
@@ -1718,22 +1408,6 @@ void B2gCudaThreadDestroyCtx(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx)
     return;
 }
 
-inline uint32_t B2gCudaScanWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx,
-                                PatternMatcherQueue *pmq, uint8_t *buf,
-                                uint16_t buflen)
-{
-    B2gCudaCtx *ctx = (B2gCudaCtx *)mpm_ctx->ctx;
-    return ctx ? ctx->Scan(mpm_ctx, mpm_thread_ctx, pmq, buf, buflen) : 0;
-}
-
-inline uint32_t B2gCudaSearchWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx,
-                                  PatternMatcherQueue *pmq, uint8_t *buf,
-                                  uint16_t buflen)
-{
-    B2gCudaCtx *ctx = (B2gCudaCtx *)mpm_ctx->ctx;
-    return ctx ? ctx->Search(mpm_ctx, mpm_thread_ctx, pmq, buf, buflen) : 0;
-}
-
 uint32_t B2gCudaScanBNDMq(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx,
                           PatternMatcherQueue *pmq, uint8_t *buf,
                           uint16_t buflen)
diff --git a/src/util-mpm-b2g-cuda.h b/src/util-mpm-b2g-cuda.h
index 0d832f3..c04322c 100644
--- a/src/util-mpm-b2g-cuda.h
+++ b/src/util-mpm-b2g-cuda.h
@@ -156,5 +156,326 @@ void B2gCudaKillDispatcherThreadAPC(void);
 void B2gCudaPushPacketTo_tv_CMB2_RC(Packet *);
 void B2gCudaPushPacketTo_tv_CMB2_APC(Packet *);
 
+/** ---- Inline functions ---- */
+
+static inline uint32_t B2gCudaScanWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx,
+                                PatternMatcherQueue *, uint8_t *buf,
+                                uint16_t buflen);
+static inline uint32_t B2gCudaSearchWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx,
+                                  PatternMatcherQueue *, uint8_t *buf,
+                                  uint16_t buflen);
+
+static inline void B2gCudaEndMatchAppend(MpmCtx *mpm_ctx, B2gCudaPattern *p,
+                                         uint16_t offset, uint16_t depth,
+                                         uint32_t pid, uint32_t sid,
+                                         uint8_t nosearch)
+{
+    MpmEndMatch *em = MpmAllocEndMatch(mpm_ctx);
+    if (em == NULL) {
+        SCLogDebug("ERROR: B2gAllocEndMatch failed");
+        return;
+    }
+
+    SCLogDebug("em alloced at %p", em);
+
+    em->id = pid;
+    em->sig_id = sid;
+    em->depth = depth;
+    em->offset = offset;
+
+    if (nosearch)
+        em->flags |= MPM_ENDMATCH_NOSEARCH;
+
+    if (p->em == NULL) {
+        p->em = em;
+        SCLogDebug("m %p m->sig_id %"PRIu32"", em, em->sig_id);
+        return;
+    }
+
+    MpmEndMatch *m = p->em;
+    while (m->next)
+        m = m->next;
+    m->next = em;
+
+    m = p->em;
+    SCLogDebug("m %p m->sig_id %" PRIu32, m, m->sig_id);
+    while (m->next) {
+        m = m->next;
+        SCLogDebug("m %p m->sig_id %" PRIu32, m, m->sig_id);
+    }
+
+    return;
+}
+
+static inline B2gCudaPattern *B2gCudaAllocPattern(MpmCtx *mpm_ctx)
+{
+    B2gCudaPattern *p = SCMalloc(sizeof(B2gCudaPattern));
+    if (p == NULL) {
+        printf("ERROR: B2gAllocPattern: malloc failed\n");
+        exit(EXIT_FAILURE);
+    }
+    memset(p, 0, sizeof(B2gCudaPattern));
+
+    mpm_ctx->memory_cnt++;
+    mpm_ctx->memory_size += sizeof(B2gCudaPattern);
+
+    return p;
+}
+
+static inline B2gCudaHashItem *B2gCudaAllocHashItem(MpmCtx *mpm_ctx)
+{
+    B2gCudaHashItem *hi = SCMalloc(sizeof(B2gCudaHashItem));
+    if (hi == NULL) {
+        printf("ERROR: B2gCudaAllocHashItem: malloc failed\n");
+        exit(EXIT_FAILURE);
+    }
+    memset(hi, 0, sizeof(B2gCudaHashItem));
+
+    mpm_ctx->memory_cnt++;
+    mpm_ctx->memory_size += sizeof(B2gCudaHashItem);
+
+    return hi;
+}
+
+static inline uint32_t B2gCudaInitHash(B2gCudaPattern *p)
+{
+    uint32_t hash = p->len * p->cs[0];
+    if (p->len > 1)
+        hash += p->cs[1];
+
+    return (hash % INIT_HASH_SIZE);
+}
+
+static inline uint32_t B2gCudaInitHashRaw(uint8_t *pat, uint16_t patlen)
+{
+    uint32_t hash = patlen * pat[0];
+    if (patlen > 1)
+        hash += pat[1];
+
+    return (hash % INIT_HASH_SIZE);
+}
+
+static inline int B2gCudaInitHashAdd(B2gCudaCtx *ctx, B2gCudaPattern *p)
+{
+    uint32_t hash = B2gCudaInitHash(p);
+
+    if (ctx->init_hash[hash] == NULL) {
+        ctx->init_hash[hash] = p;
+        return 0;
+    }
+
+    B2gCudaPattern *tt = NULL;
+    B2gCudaPattern *t = ctx->init_hash[hash];
+
+    /* get the list tail */
+    do {
+        tt = t;
+        t = t->next;
+    } while (t != NULL);
+
+    tt->next = p;
+
+    return 0;
+}
+
+static inline int B2gCudaCmpPattern(B2gCudaPattern *p, uint8_t *pat,
+                                    uint16_t patlen, char nocase);
+
+static inline B2gCudaPattern *B2gCudaInitHashLookup(B2gCudaCtx *ctx, uint8_t *pat,
+                                                    uint16_t patlen, char nocase)
+{
+    uint32_t hash = B2gCudaInitHashRaw(pat, patlen);
+
+    if (ctx->init_hash[hash] == NULL)
+        return NULL;
+
+    B2gCudaPattern *t = ctx->init_hash[hash];
+    for ( ; t != NULL; t = t->next) {
+        if (B2gCudaCmpPattern(t, pat, patlen, nocase) == 1)
+            return t;
+    }
+
+    return NULL;
+}
+
+static inline int B2gCudaCmpPattern(B2gCudaPattern *p, uint8_t *pat,
+                                    uint16_t patlen, char nocase)
+{
+    if (p->len != patlen)
+        return 0;
+
+    if (!((nocase && p->flags & B2G_CUDA_NOCASE) ||
+          (!nocase && !(p->flags & B2G_CUDA_NOCASE)))) {
+        return 0;
+    }
+
+    if (memcmp(p->cs, pat, patlen) != 0)
+        return 0;
+
+    return 1;
+}
+
+static inline int B2gCudaAddPattern(MpmCtx *mpm_ctx, uint8_t *pat,
+                                    uint16_t patlen, uint16_t offset,
+                                    uint16_t depth, char nocase, char scan,
+                                    uint32_t pid, uint32_t sid,
+                                    uint8_t nosearch)
+{
+    B2gCudaCtx *ctx = (B2gCudaCtx *)mpm_ctx->ctx;
+
+    SCLogDebug("ctx %p len %"PRIu16" pid %" PRIu32 ", nocase %s",
+               ctx, patlen, pid, nocase ? "true" : "false");
+
+    if (patlen == 0)
+        return 0;
+
+    /* get a memory piece */
+    B2gCudaPattern *p = B2gCudaInitHashLookup(ctx, pat, patlen, nocase);
+    if (p == NULL) {
+        SCLogDebug("allocing new pattern");
+
+        p = B2gCudaAllocPattern(mpm_ctx);
+        if (p == NULL)
+            goto error;
+
+        p->len = patlen;
+
+        if (nocase)
+            p->flags |= B2G_CUDA_NOCASE;
+
+        /* setup the case insensitive part of the pattern */
+        p->ci = SCMalloc(patlen);
+        if (p->ci == NULL)
+            goto error;
+        mpm_ctx->memory_cnt++;
+        mpm_ctx->memory_size += patlen;
+        memcpy_tolower(p->ci, pat, patlen);
+
+        /* setup the case sensitive part of the pattern */
+        if (p->flags & B2G_CUDA_NOCASE) {
+            /* nocase means no difference between cs and ci */
+            p->cs = p->ci;
+        } else {
+            if (memcmp(p->ci,pat,p->len) == 0) {
+                /* no diff between cs and ci: pat is lowercase */
+                p->cs = p->ci;
+            } else {
+                p->cs = SCMalloc(patlen);
+                if (p->cs == NULL)
+                    goto error;
+                mpm_ctx->memory_cnt++;
+                mpm_ctx->memory_size += patlen;
+                memcpy(p->cs, pat, patlen);
+            }
+        }
+
+        /* put in the pattern hash */
+        B2gCudaInitHashAdd(ctx, p);
+
+        if (mpm_ctx->pattern_cnt == 65535) {
+            printf("Max search words reached\n");
+            exit(1);
+        }
+        if (scan)
+            mpm_ctx->scan_pattern_cnt++;
+        mpm_ctx->pattern_cnt++;
+
+        if (scan) { /* SCAN */
+            if (mpm_ctx->scan_maxlen < patlen)
+                mpm_ctx->scan_maxlen = patlen;
+
+            if (mpm_ctx->scan_minlen == 0)
+                mpm_ctx->scan_minlen = patlen;
+            else if (mpm_ctx->scan_minlen > patlen)
+                mpm_ctx->scan_minlen = patlen;
+
+            p->flags |= B2G_CUDA_SCAN;
+        } else { /* SEARCH */
+            if (mpm_ctx->search_maxlen < patlen)
+                mpm_ctx->search_maxlen = patlen;
+
+            if (mpm_ctx->search_minlen == 0)
+                mpm_ctx->search_minlen = patlen;
+            else if (mpm_ctx->search_minlen > patlen)
+                mpm_ctx->search_minlen = patlen;
+        }
+    } else {
+        /* if we're reusing a pattern, check we need to check that it is a
+         * scan pattern if that is what we're adding. If so we set the pattern
+         * to be a scan pattern. */
+        if (scan) {
+            p->flags |= B2G_CUDA_SCAN;
+
+            if (mpm_ctx->scan_maxlen < patlen)
+                mpm_ctx->scan_maxlen = patlen;
+
+            if (mpm_ctx->scan_minlen == 0)
+                mpm_ctx->scan_minlen = patlen;
+            else if (mpm_ctx->scan_minlen > patlen)
+                mpm_ctx->scan_minlen = patlen;
+        }
+    }
+
+    /* we need a match */
+    B2gCudaEndMatchAppend(mpm_ctx, p, offset, depth, pid, sid, nosearch);
+
+    mpm_ctx->total_pattern_cnt++;
+
+    return 0;
+
+error:
+    B2gCudaFreePattern(mpm_ctx, p);
+    return -1;
+}
+
+static inline uint32_t B2gCudaBloomHash(void *data, uint16_t datalen, uint8_t iter,
+                                        uint32_t hash_size)
+{
+     uint8_t *d = (uint8_t *)data;
+     uint16_t i;
+     uint32_t hash = (uint32_t)u8_tolower(*d);
+
+     for (i = 1; i < datalen; i++) {
+         d++;
+         hash += (u8_tolower(*d)) ^ i;
+     }
+     hash <<= (iter+1);
+     hash %= hash_size;
+
+     return hash;
+}
+
+static inline int memcmp_lowercase(uint8_t *s1, uint8_t *s2, uint16_t n)
+{
+    size_t i;
+
+    /* check backwards because we already tested the first
+     * 2 to 4 chars. This way we are more likely to detect
+     * a miss and thus speed up a little... */
+    for (i = n - 1; i; i--) {
+        if (u8_tolower(*(s2+i)) != s1[i])
+            return 1;
+    }
+
+    return 0;
+}
+
+static inline uint32_t B2gCudaScanWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx,
+                                PatternMatcherQueue *pmq, uint8_t *buf,
+                                uint16_t buflen)
+{
+    B2gCudaCtx *ctx = (B2gCudaCtx *)mpm_ctx->ctx;
+    return ctx ? ctx->Scan(mpm_ctx, mpm_thread_ctx, pmq, buf, buflen) : 0;
+}
+
+static inline uint32_t B2gCudaSearchWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx,
+                                  PatternMatcherQueue *pmq, uint8_t *buf,
+                                  uint16_t buflen)
+{
+    B2gCudaCtx *ctx = (B2gCudaCtx *)mpm_ctx->ctx;
+    return ctx ? ctx->Search(mpm_ctx, mpm_thread_ctx, pmq, buf, buflen) : 0;
+}
+
+
 #endif /* __SC_CUDA_SUPPORT__ */
 #endif /* __UTIL_MPM_B2G_CUDA_H__ */
diff --git a/src/util-mpm-b2g.c b/src/util-mpm-b2g.c
index d551535..da9f1d1 100644
--- a/src/util-mpm-b2g.c
+++ b/src/util-mpm-b2g.c
@@ -48,8 +48,6 @@ int B2gAddScanPatternCS(MpmCtx *, uint8_t *, uint16_t, uint16_t, uint16_t, uint3
 int B2gAddPatternCI(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, uint32_t sid);
 int B2gAddPatternCS(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, uint32_t sid);
 int B2gPreparePatterns(MpmCtx *mpm_ctx);
-inline uint32_t B2gScanWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *, uint8_t *buf, uint16_t buflen);
-inline uint32_t B2gSearchWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *, uint8_t *buf, uint16_t buflen);
 uint32_t B2gScan1(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *, uint8_t *buf, uint16_t buflen);
 #ifdef B2G_SCAN2
 uint32_t B2gScan2(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *, uint8_t *buf, uint16_t buflen);
@@ -83,51 +81,6 @@ void MpmB2gRegister (void) {
     mpm_table[MPM_B2G].RegisterUnittests = B2gRegisterTests;
 }
 
-/* append an endmatch to a pattern
- *
- * Only used in the initialization phase */
-static inline void B2gEndMatchAppend(MpmCtx *mpm_ctx, B2gPattern *p,
-    uint16_t offset, uint16_t depth, uint32_t pid, uint32_t sid,
-    uint8_t nosearch)
-{
-    SCLogDebug("pid %"PRIu32", sid %"PRIu32"", pid, sid);
-
-    MpmEndMatch *em = MpmAllocEndMatch(mpm_ctx);
-    if (em == NULL) {
-        printf("ERROR: B2gAllocEndMatch failed\n");
-        return;
-    }
-
-    SCLogDebug("em alloced at %p", em);
-
-    em->id = pid;
-    em->sig_id = sid;
-    em->depth = depth;
-    em->offset = offset;
-
-    if (nosearch)
-        em->flags |= MPM_ENDMATCH_NOSEARCH;
-
-    if (p->em == NULL) {
-        p->em = em;
-        SCLogDebug("m %p m->sig_id %"PRIu32"", em, em->sig_id);
-        return;
-    }
-
-    MpmEndMatch *m = p->em;
-    while (m->next) {
-        m = m->next;
-    }
-    m->next = em;
-
-    m = p->em;
-    SCLogDebug("m %p m->sig_id %"PRIu32"", m, m->sig_id);
-    while (m->next) {
-        m = m->next;
-        SCLogDebug("m %p m->sig_id %"PRIu32"", m, m->sig_id);
-    }
-}
-
 #ifdef PRINTMATCH
 static void prt (uint8_t *buf, uint16_t buflen) {
     uint16_t i;
@@ -160,33 +113,6 @@ void B2gPrintInfo(MpmCtx *mpm_ctx) {
     printf("\n");
 }
 
-static inline B2gPattern *B2gAllocPattern(MpmCtx *mpm_ctx) {
-    B2gPattern *p = SCMalloc(sizeof(B2gPattern));
-    if (p == NULL) {
-        printf("ERROR: B2gAllocPattern: SCMalloc failed\n");
-        exit(EXIT_FAILURE);
-    }
-    memset(p,0,sizeof(B2gPattern));
-
-    mpm_ctx->memory_cnt++;
-    mpm_ctx->memory_size += sizeof(B2gPattern);
-    return p;
-}
-
-static inline B2gHashItem *
-B2gAllocHashItem(MpmCtx *mpm_ctx) {
-    B2gHashItem *hi = SCMalloc(sizeof(B2gHashItem));
-    if (hi == NULL) {
-        printf("ERROR: B2gAllocHashItem: SCMalloc failed\n");
-        exit(EXIT_FAILURE);
-    }
-    memset(hi,0,sizeof(B2gHashItem));
-
-    mpm_ctx->memory_cnt++;
-    mpm_ctx->memory_size += sizeof(B2gHashItem);
-    return hi;
-}
-
 static void B2gHashFree(MpmCtx *mpm_ctx, B2gHashItem *hi) {
     if (hi == NULL)
         return;
@@ -199,91 +125,6 @@ static void B2gHashFree(MpmCtx *mpm_ctx, B2gHashItem *hi) {
     SCFree(hi);
 }
 
-static inline void memcpy_tolower(uint8_t *d, uint8_t *s, uint16_t len) {
-    uint16_t i;
-    for (i = 0; i < len; i++) {
-        d[i] = u8_tolower(s[i]);
-    }
-}
-
-/*
- * INIT HASH START
- */
-static inline uint32_t B2gInitHash(B2gPattern *p) {
-    uint32_t hash = p->len * p->cs[0];
-    if (p->len > 1)
-        hash += p->cs[1];
-
-    return (hash % INIT_HASH_SIZE);
-}
-
-static inline uint32_t B2gInitHashRaw(uint8_t *pat, uint16_t patlen) {
-    uint32_t hash = patlen * pat[0];
-    if (patlen > 1)
-        hash += pat[1];
-
-    return (hash % INIT_HASH_SIZE);
-}
-
-static inline int B2gInitHashAdd(B2gCtx *ctx, B2gPattern *p) {
-    uint32_t hash = B2gInitHash(p);
-
-    //printf("B2gInitHashAdd: %" PRIu32 "\n", hash);
-
-    if (ctx->init_hash[hash] == NULL) {
-        ctx->init_hash[hash] = p;
-        //printf("B2gInitHashAdd: hash %" PRIu32 ", head %p\n", hash, ctx->init_hash[hash]);
-        return 0;
-    }
-
-    B2gPattern *tt = NULL;
-    B2gPattern *t = ctx->init_hash[hash];
-
-    /* get the list tail */
-    do {
-        tt = t;
-        t = t->next;
-    } while (t != NULL);
-
-    tt->next = p;
-
-    //printf("B2gInitHashAdd: hash %" PRIu32 ", head %p\n", hash, ctx->init_hash[hash]);
-    return 0;
-}
-
-static inline int B2gCmpPattern(B2gPattern *p, uint8_t *pat, uint16_t patlen, char nocase);
-
-static inline B2gPattern *B2gInitHashLookup(B2gCtx *ctx, uint8_t *pat, uint16_t patlen, char nocase) {
-    uint32_t hash = B2gInitHashRaw(pat,patlen);
-
-    //printf("B2gInitHashLookup: %" PRIu32 ", head %p\n", hash, ctx->init_hash[hash]);
-
-    if (ctx->init_hash[hash] == NULL) {
-        return NULL;
-    }
-
-    B2gPattern *t = ctx->init_hash[hash];
-    for ( ; t != NULL; t = t->next) {
-        if (B2gCmpPattern(t,pat,patlen,nocase) == 1)
-            return t;
-    }
-
-    return NULL;
-}
-
-static inline int B2gCmpPattern(B2gPattern *p, uint8_t *pat, uint16_t patlen, char nocase) {
-    if (p->len != patlen)
-        return 0;
-
-    if (!((nocase && p->flags & B2G_NOCASE) || (!nocase && !(p->flags & B2G_NOCASE))))
-        return 0;
-
-    if (memcmp(p->cs, pat, patlen) != 0)
-        return 0;
-
-    return 1;
-}
-
 /*
  * INIT HASH END
  */
@@ -312,112 +153,6 @@ void B2gFreePattern(MpmCtx *mpm_ctx, B2gPattern *p) {
     }
 }
 
-/* B2gAddPattern
- *
- * pat: ptr to the pattern
- * patlen: length of the pattern
- * nocase: nocase flag: 1 enabled, 0 disable
- * pid: pattern id
- * sid: signature id (internal id)
- */
-static inline int B2gAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, char nocase, char scan, uint32_t pid, uint32_t sid, uint8_t nosearch) {
-    B2gCtx *ctx = (B2gCtx *)mpm_ctx->ctx;
-
-    SCLogDebug("ctx %p len %"PRIu16" pid %" PRIu32 ", nocase %s", ctx, patlen, pid, nocase ? "true" : "false");
-
-    if (patlen == 0)
-        return 0;
-
-    /* get a memory piece */
-    B2gPattern *p = B2gInitHashLookup(ctx, pat, patlen, nocase);
-    if (p == NULL) {
-        SCLogDebug("allocing new pattern");
-
-        p = B2gAllocPattern(mpm_ctx);
-        if (p == NULL)
-            goto error;
-
-        p->len = patlen;
-
-        if (nocase) p->flags |= B2G_NOCASE;
-
-        /* setup the case insensitive part of the pattern */
-        p->ci = SCMalloc(patlen);
-        if (p->ci == NULL) goto error;
-        mpm_ctx->memory_cnt++;
-        mpm_ctx->memory_size += patlen;
-        memcpy_tolower(p->ci, pat, patlen);
-
-        /* setup the case sensitive part of the pattern */
-        if (p->flags & B2G_NOCASE) {
-            /* nocase means no difference between cs and ci */
-            p->cs = p->ci;
-        } else {
-            if (memcmp(p->ci,pat,p->len) == 0) {
-                /* no diff between cs and ci: pat is lowercase */
-                p->cs = p->ci;
-            } else {
-                p->cs = SCMalloc(patlen);
-                if (p->cs == NULL) goto error;
-                mpm_ctx->memory_cnt++;
-                mpm_ctx->memory_size += patlen;
-                memcpy(p->cs, pat, patlen);
-            }
-        }
-
-        //printf("B2gAddPattern: ci \""); prt(p->ci,p->len);
-        //printf("\" cs \""); prt(p->cs,p->len);
-        //printf("\"\n");
-
-        /* put in the pattern hash */
-        B2gInitHashAdd(ctx, p);
-
-        if (mpm_ctx->pattern_cnt == 65535) {
-            printf("Max search words reached\n");
-            exit(1);
-        }
-        if (scan) mpm_ctx->scan_pattern_cnt++;
-        mpm_ctx->pattern_cnt++;
-
-        if (scan) { /* SCAN */
-            if (mpm_ctx->scan_maxlen < patlen) mpm_ctx->scan_maxlen = patlen;
-            if (mpm_ctx->scan_minlen == 0) mpm_ctx->scan_minlen = patlen;
-            else if (mpm_ctx->scan_minlen > patlen) mpm_ctx->scan_minlen = patlen;
-            p->flags |= B2G_SCAN;
-        } else { /* SEARCH */
-            if (mpm_ctx->search_maxlen < patlen) mpm_ctx->search_maxlen = patlen;
-            if (mpm_ctx->search_minlen == 0) mpm_ctx->search_minlen = patlen;
-            else if (mpm_ctx->search_minlen > patlen) mpm_ctx->search_minlen = patlen;
-        }
-    } else {
-        /* if we're reusing a pattern, check we need to check that it is a
-         * scan pattern if that is what we're adding. If so we set the pattern
-         * to be a scan pattern. */
-
-        //printf("reusing B2gAddPattern: ci \""); prt(p->ci,p->len);
-        //printf("\" cs \""); prt(p->cs,p->len);
-        //printf("\"\n");
-
-        if (scan) {
-            p->flags |= B2G_SCAN;
-
-            if (mpm_ctx->scan_maxlen < patlen) mpm_ctx->scan_maxlen = patlen;
-            if (mpm_ctx->scan_minlen == 0) mpm_ctx->scan_minlen = patlen;
-            else if (mpm_ctx->scan_minlen > patlen) mpm_ctx->scan_minlen = patlen;
-        }
-    }
-
-    /* we need a match */
-    B2gEndMatchAppend(mpm_ctx, p, offset, depth, pid, sid, nosearch);
-
-    mpm_ctx->total_pattern_cnt++;
-    return 0;
-
-error:
-    B2gFreePattern(mpm_ctx, p);
-    return -1;
-}
-
 int B2gAddScanPatternCI(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen,
     uint16_t offset, uint16_t depth, uint32_t pid, uint32_t sid, uint8_t nosearch)
 {
@@ -442,21 +177,6 @@ int B2gAddPatternCS(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen,
     return B2gAddPattern(mpm_ctx, pat, patlen, offset, depth, /* nocase */0, /* scan */0, pid, sid, 0);
 }
 
-static inline uint32_t B2gBloomHash(void *data, uint16_t datalen, uint8_t iter, uint32_t hash_size) {
-     uint8_t *d = (uint8_t *)data;
-     uint16_t i;
-     uint32_t hash = (uint32_t)u8_tolower(*d);
-
-     for (i = 1; i < datalen; i++) {
-         d++;
-         hash += (u8_tolower(*d)) ^ i;
-     }
-     hash <<= (iter+1);
-
-     hash %= hash_size;
-     return hash;
-}
-
 static void B2gPrepareScanHash(MpmCtx *mpm_ctx) {
     B2gCtx *ctx = (B2gCtx *)mpm_ctx->ctx;
     uint16_t i;
@@ -909,21 +629,6 @@ void B2gPrintSearchStats(MpmThreadCtx *mpm_thread_ctx) {
 #endif /* B2G_COUNTERS */
 }
 
-static inline int
-memcmp_lowercase(uint8_t *s1, uint8_t *s2, uint16_t n) {
-    size_t i;
-
-    /* check backwards because we already tested the first
-     * 2 to 4 chars. This way we are more likely to detect
-     * a miss and thus speed up a little... */
-    for (i = n - 1; i; i--) {
-        if (u8_tolower(*(s2+i)) != s1[i])
-            return 1;
-    }
-
-    return 0;
-}
-
 /**
  * \brief   Function to get the user defined values for b2g algorithm from the
  *          config file 'suricata.yaml'
@@ -1195,16 +900,6 @@ void B2gThreadDestroyCtx(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx) {
     MpmMatchFreeSpares(mpm_thread_ctx, mpm_thread_ctx->qlist);
 }
 
-inline uint32_t B2gScanWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) {
-    B2gCtx *ctx = (B2gCtx *)mpm_ctx->ctx;
-    return ctx ? ctx->Scan(mpm_ctx, mpm_thread_ctx, pmq, buf, buflen) : 0;
-}
-
-inline uint32_t B2gSearchWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) {
-    B2gCtx *ctx = (B2gCtx *)mpm_ctx->ctx;
-    return ctx ? ctx->Search(mpm_ctx, mpm_thread_ctx, pmq, buf, buflen) : 0;
-}
-
 uint32_t B2gScanBNDMq(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) {
     B2gCtx *ctx = (B2gCtx *)mpm_ctx->ctx;
 #ifdef B2G_COUNTERS
diff --git a/src/util-mpm-b2g.h b/src/util-mpm-b2g.h
index c1a5520..b114482 100644
--- a/src/util-mpm-b2g.h
+++ b/src/util-mpm-b2g.h
@@ -3,6 +3,8 @@
 
 #include "util-mpm.h"
 #include "util-bloomfilter.h"
+#include "suricata-common.h"
+#include "suricata.h"
 
 #define B2G_NOCASE 0x01
 #define B2G_SCAN   0x02
@@ -23,6 +25,8 @@
 //#define B2G_WORD_SIZE 16
 //#define B2G_WORD_SIZE 8
 
+#define INIT_HASH_SIZE 65536
+
 #define B2G_HASH16(a,b) (((a)<<B2G_HASHSHIFT) | (b))
 #define B2G_Q           2
 
@@ -127,6 +131,293 @@ typedef struct B2gThreadCtx_ {
 
 void MpmB2gRegister(void);
 
+/** ----- Inline functions ----- */
+
+static inline uint32_t B2gScanWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *, uint8_t *buf, uint16_t buflen);
+static inline uint32_t B2gSearchWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *, uint8_t *buf, uint16_t buflen);
+void B2gFreePattern(MpmCtx *, B2gPattern *);
+
+/* append an endmatch to a pattern
+ *
+ * Only used in the initialization phase */
+static inline void B2gEndMatchAppend(MpmCtx *mpm_ctx, B2gPattern *p,
+    uint16_t offset, uint16_t depth, uint32_t pid, uint32_t sid,
+    uint8_t nosearch)
+{
+    SCLogDebug("pid %"PRIu32", sid %"PRIu32"", pid, sid);
+
+    MpmEndMatch *em = MpmAllocEndMatch(mpm_ctx);
+    if (em == NULL) {
+        printf("ERROR: B2gAllocEndMatch failed\n");
+        return;
+    }
+
+    SCLogDebug("em alloced at %p", em);
+
+    em->id = pid;
+    em->sig_id = sid;
+    em->depth = depth;
+    em->offset = offset;
+
+    if (nosearch)
+        em->flags |= MPM_ENDMATCH_NOSEARCH;
+
+    if (p->em == NULL) {
+        p->em = em;
+        SCLogDebug("m %p m->sig_id %"PRIu32"", em, em->sig_id);
+        return;
+    }
+
+    MpmEndMatch *m = p->em;
+    while (m->next) {
+        m = m->next;
+    }
+    m->next = em;
+
+    m = p->em;
+    SCLogDebug("m %p m->sig_id %"PRIu32"", m, m->sig_id);
+    while (m->next) {
+        m = m->next;
+        SCLogDebug("m %p m->sig_id %"PRIu32"", m, m->sig_id);
+    }
+}
+
+static inline uint32_t B2gScanWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) {
+    B2gCtx *ctx = (B2gCtx *)mpm_ctx->ctx;
+    return ctx ? ctx->Scan(mpm_ctx, mpm_thread_ctx, pmq, buf, buflen) : 0;
+}
+
+static inline uint32_t B2gSearchWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) {
+    B2gCtx *ctx = (B2gCtx *)mpm_ctx->ctx;
+    return ctx ? ctx->Search(mpm_ctx, mpm_thread_ctx, pmq, buf, buflen) : 0;
+}
+
+static inline B2gPattern *B2gAllocPattern(MpmCtx *mpm_ctx) {
+    B2gPattern *p = SCMalloc(sizeof(B2gPattern));
+    if (p == NULL) {
+        printf("ERROR: B2gAllocPattern: SCMalloc failed\n");
+        exit(EXIT_FAILURE);
+    }
+    memset(p,0,sizeof(B2gPattern));
+
+    mpm_ctx->memory_cnt++;
+    mpm_ctx->memory_size += sizeof(B2gPattern);
+    return p;
+}
+
+static inline B2gHashItem *
+B2gAllocHashItem(MpmCtx *mpm_ctx) {
+    B2gHashItem *hi = SCMalloc(sizeof(B2gHashItem));
+    if (hi == NULL) {
+        printf("ERROR: B2gAllocHashItem: SCMalloc failed\n");
+        exit(EXIT_FAILURE);
+    }
+    memset(hi,0,sizeof(B2gHashItem));
+
+    mpm_ctx->memory_cnt++;
+    mpm_ctx->memory_size += sizeof(B2gHashItem);
+    return hi;
+}
+
+/*
+ * INIT HASH START
+ */
+static inline uint32_t B2gInitHash(B2gPattern *p) {
+    uint32_t hash = p->len * p->cs[0];
+    if (p->len > 1)
+        hash += p->cs[1];
+
+    return (hash % INIT_HASH_SIZE);
+}
+
+static inline uint32_t B2gInitHashRaw(uint8_t *pat, uint16_t patlen) {
+    uint32_t hash = patlen * pat[0];
+    if (patlen > 1)
+        hash += pat[1];
+
+    return (hash % INIT_HASH_SIZE);
+}
+
+static inline int B2gInitHashAdd(B2gCtx *ctx, B2gPattern *p) {
+    uint32_t hash = B2gInitHash(p);
+
+    //printf("B2gInitHashAdd: %" PRIu32 "\n", hash);
+
+    if (ctx->init_hash[hash] == NULL) {
+        ctx->init_hash[hash] = p;
+        //printf("B2gInitHashAdd: hash %" PRIu32 ", head %p\n", hash, ctx->init_hash[hash]);
+        return 0;
+    }
+
+    B2gPattern *tt = NULL;
+    B2gPattern *t = ctx->init_hash[hash];
+
+    /* get the list tail */
+    do {
+        tt = t;
+        t = t->next;
+    } while (t != NULL);
+
+    tt->next = p;
+
+    //printf("B2gInitHashAdd: hash %" PRIu32 ", head %p\n", hash, ctx->init_hash[hash]);
+    return 0;
+}
+
+static inline int B2gCmpPattern(B2gPattern *p, uint8_t *pat, uint16_t patlen, char nocase);
+
+static inline B2gPattern *B2gInitHashLookup(B2gCtx *ctx, uint8_t *pat, uint16_t patlen, char nocase) {
+    uint32_t hash = B2gInitHashRaw(pat,patlen);
+
+    //printf("B2gInitHashLookup: %" PRIu32 ", head %p\n", hash, ctx->init_hash[hash]);
+
+    if (ctx->init_hash[hash] == NULL) {
+        return NULL;
+    }
+
+    B2gPattern *t = ctx->init_hash[hash];
+    for ( ; t != NULL; t = t->next) {
+        if (B2gCmpPattern(t,pat,patlen,nocase) == 1)
+            return t;
+    }
+
+    return NULL;
+}
+
+static inline int B2gCmpPattern(B2gPattern *p, uint8_t *pat, uint16_t patlen, char nocase) {
+    if (p->len != patlen)
+        return 0;
+
+    if (!((nocase && p->flags & B2G_NOCASE) || (!nocase && !(p->flags & B2G_NOCASE))))
+        return 0;
+
+    if (memcmp(p->cs, pat, patlen) != 0)
+        return 0;
+
+    return 1;
+}
+
+/* B2gAddPattern
+ *
+ * pat: ptr to the pattern
+ * patlen: length of the pattern
+ * nocase: nocase flag: 1 enabled, 0 disable
+ * pid: pattern id
+ * sid: signature id (internal id)
+ */
+static inline int B2gAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, char nocase, char scan, uint32_t pid, uint32_t sid, uint8_t nosearch) {
+    B2gCtx *ctx = (B2gCtx *)mpm_ctx->ctx;
+
+    SCLogDebug("ctx %p len %"PRIu16" pid %" PRIu32 ", nocase %s", ctx, patlen, pid, nocase ? "true" : "false");
+
+    if (patlen == 0)
+        return 0;
+
+    /* get a memory piece */
+    B2gPattern *p = B2gInitHashLookup(ctx, pat, patlen, nocase);
+    if (p == NULL) {
+        SCLogDebug("allocing new pattern");
+
+        p = B2gAllocPattern(mpm_ctx);
+        if (p == NULL)
+            goto error;
+
+        p->len = patlen;
+
+        if (nocase) p->flags |= B2G_NOCASE;
+
+        /* setup the case insensitive part of the pattern */
+        p->ci = SCMalloc(patlen);
+        if (p->ci == NULL) goto error;
+        mpm_ctx->memory_cnt++;
+        mpm_ctx->memory_size += patlen;
+        memcpy_tolower(p->ci, pat, patlen);
+
+        /* setup the case sensitive part of the pattern */
+        if (p->flags & B2G_NOCASE) {
+            /* nocase means no difference between cs and ci */
+            p->cs = p->ci;
+        } else {
+            if (memcmp(p->ci,pat,p->len) == 0) {
+                /* no diff between cs and ci: pat is lowercase */
+                p->cs = p->ci;
+            } else {
+                p->cs = SCMalloc(patlen);
+                if (p->cs == NULL) goto error;
+                mpm_ctx->memory_cnt++;
+                mpm_ctx->memory_size += patlen;
+                memcpy(p->cs, pat, patlen);
+            }
+        }
+
+        //printf("B2gAddPattern: ci \""); prt(p->ci,p->len);
+        //printf("\" cs \""); prt(p->cs,p->len);
+        //printf("\"\n");
+
+        /* put in the pattern hash */
+        B2gInitHashAdd(ctx, p);
+
+        if (mpm_ctx->pattern_cnt == 65535) {
+            printf("Max search words reached\n");
+            exit(1);
+        }
+        if (scan) mpm_ctx->scan_pattern_cnt++;
+        mpm_ctx->pattern_cnt++;
+
+        if (scan) { /* SCAN */
+            if (mpm_ctx->scan_maxlen < patlen) mpm_ctx->scan_maxlen = patlen;
+            if (mpm_ctx->scan_minlen == 0) mpm_ctx->scan_minlen = patlen;
+            else if (mpm_ctx->scan_minlen > patlen) mpm_ctx->scan_minlen = patlen;
+            p->flags |= B2G_SCAN;
+        } else { /* SEARCH */
+            if (mpm_ctx->search_maxlen < patlen) mpm_ctx->search_maxlen = patlen;
+            if (mpm_ctx->search_minlen == 0) mpm_ctx->search_minlen = patlen;
+            else if (mpm_ctx->search_minlen > patlen) mpm_ctx->search_minlen = patlen;
+        }
+    } else {
+        /* if we're reusing a pattern, check we need to check that it is a
+         * scan pattern if that is what we're adding. If so we set the pattern
+         * to be a scan pattern. */
+
+        //printf("reusing B2gAddPattern: ci \""); prt(p->ci,p->len);
+        //printf("\" cs \""); prt(p->cs,p->len);
+        //printf("\"\n");
+
+        if (scan) {
+            p->flags |= B2G_SCAN;
+
+            if (mpm_ctx->scan_maxlen < patlen) mpm_ctx->scan_maxlen = patlen;
+            if (mpm_ctx->scan_minlen == 0) mpm_ctx->scan_minlen = patlen;
+            else if (mpm_ctx->scan_minlen > patlen) mpm_ctx->scan_minlen = patlen;
+        }
+    }
+
+    /* we need a match */
+    B2gEndMatchAppend(mpm_ctx, p, offset, depth, pid, sid, nosearch);
+
+    mpm_ctx->total_pattern_cnt++;
+    return 0;
+
+error:
+    B2gFreePattern(mpm_ctx, p);
+    return -1;
+}
+
+static inline uint32_t B2gBloomHash(void *data, uint16_t datalen, uint8_t iter, uint32_t hash_size) {
+     uint8_t *d = (uint8_t *)data;
+     uint16_t i;
+     uint32_t hash = (uint32_t)u8_tolower(*d);
+
+     for (i = 1; i < datalen; i++) {
+         d++;
+         hash += (u8_tolower(*d)) ^ i;
+     }
+     hash <<= (iter+1);
+
+     hash %= hash_size;
+     return hash;
+}
+
 
 #endif
 
diff --git a/src/util-mpm-b3g.c b/src/util-mpm-b3g.c
index 2d532d4..12d046a 100644
--- a/src/util-mpm-b3g.c
+++ b/src/util-mpm-b3g.c
@@ -20,8 +20,6 @@
 #include "conf.h"
 #include "util-debug.h"
 
-#define INIT_HASH_SIZE 65536
-
 #ifdef B3G_COUNTERS
 #define COUNT(counter) \
         (counter)
@@ -43,8 +41,6 @@ int B3gAddScanPatternCS(MpmCtx *, uint8_t *, uint16_t, uint16_t, uint16_t, uint3
 int B3gAddPatternCI(MpmCtx *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, uint32_t);
 int B3gAddPatternCS(MpmCtx *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, uint32_t);
 int B3gPreparePatterns(MpmCtx *);
-inline uint32_t B3gScanWrap(MpmCtx *, MpmThreadCtx *, PatternMatcherQueue *, uint8_t *, uint16_t);
-inline uint32_t B3gSearchWrap(MpmCtx *, MpmThreadCtx *, PatternMatcherQueue *, uint8_t *, uint16_t);
 uint32_t B3gScan1(MpmCtx *, MpmThreadCtx *, PatternMatcherQueue *, uint8_t *, uint16_t);
 uint32_t B3gScan2(MpmCtx *, MpmThreadCtx *, PatternMatcherQueue *, uint8_t *, uint16_t);
 uint32_t B3gScan12(MpmCtx *, MpmThreadCtx *, PatternMatcherQueue *, uint8_t *, uint16_t);
@@ -79,39 +75,6 @@ void MpmB3gRegister (void) {
     mpm_table[MPM_B3G].RegisterUnittests = B3gRegisterTests;
 }
 
-/* append an endmatch to a pattern
- *
- * Only used in the initialization phase */
-static inline void B3gEndMatchAppend(MpmCtx *mpm_ctx, B3gPattern *p,
-    uint16_t offset, uint16_t depth, uint32_t pid, uint32_t sid,
-    uint8_t nosearch)
-{
-    MpmEndMatch *em = MpmAllocEndMatch(mpm_ctx);
-    if (em == NULL) {
-        printf("ERROR: B3gAllocEndMatch failed\n");
-        return;
-    }
-
-    em->id = pid;
-    em->sig_id = sid;
-    em->depth = depth;
-    em->offset = offset;
-
-    if (nosearch)
-        em->flags |= MPM_ENDMATCH_NOSEARCH;
-
-    if (p->em == NULL) {
-        p->em = em;
-        return;
-    }
-
-    MpmEndMatch *m = p->em;
-    while (m->next) {
-        m = m->next;
-    }
-    m->next = em;
-}
-
 /** \todo XXX Unused??? */
 #if 0
 static void prt (uint8_t *buf, uint16_t buflen) {
@@ -145,33 +108,6 @@ void B3gPrintInfo(MpmCtx *mpm_ctx) {
     printf("\n");
 }
 
-static inline B3gPattern *B3gAllocPattern(MpmCtx *mpm_ctx) {
-    B3gPattern *p = SCMalloc(sizeof(B3gPattern));
-    if (p == NULL) {
-        printf("ERROR: B3gAllocPattern: SCMalloc failed\n");
-        exit(EXIT_FAILURE);
-    }
-    memset(p,0,sizeof(B3gPattern));
-
-    mpm_ctx->memory_cnt++;
-    mpm_ctx->memory_size += sizeof(B3gPattern);
-    return p;
-}
-
-static inline B3gHashItem *
-B3gAllocHashItem(MpmCtx *mpm_ctx) {
-    B3gHashItem *hi = SCMalloc(sizeof(B3gHashItem));
-    if (hi == NULL) {
-        printf("ERROR: B3gAllocHashItem: SCMalloc failed\n");
-        exit(EXIT_FAILURE);
-    }
-    memset(hi,0,sizeof(B3gHashItem));
-
-    mpm_ctx->memory_cnt++;
-    mpm_ctx->memory_size += sizeof(B3gHashItem);
-    return hi;
-}
-
 static void B3gHashFree(MpmCtx *mpm_ctx, B3gHashItem *hi) {
     if (hi == NULL)
         return;
@@ -184,91 +120,6 @@ static void B3gHashFree(MpmCtx *mpm_ctx, B3gHashItem *hi) {
     SCFree(hi);
 }
 
-static inline void memcpy_tolower(uint8_t *d, uint8_t *s, uint16_t len) {
-    uint16_t i;
-    for (i = 0; i < len; i++) {
-        d[i] = u8_tolower(s[i]);
-    }
-}
-
-/*
- * INIT HASH START
- */
-static inline uint32_t B3gInitHash(B3gPattern *p) {
-    uint32_t hash = p->len * p->cs[0];
-    if (p->len > 1)
-        hash += p->cs[1];
-
-    return (hash % INIT_HASH_SIZE);
-}
-
-static inline uint32_t B3gInitHashRaw(uint8_t *pat, uint16_t patlen) {
-    uint32_t hash = patlen * pat[0];
-    if (patlen > 1)
-        hash += pat[1];
-
-    return (hash % INIT_HASH_SIZE);
-}
-
-static inline int B3gInitHashAdd(B3gCtx *ctx, B3gPattern *p) {
-    uint32_t hash = B3gInitHash(p);
-
-    //printf("B3gInitHashAdd: %" PRIu32 "\n", hash);
-
-    if (ctx->init_hash[hash] == NULL) {
-        ctx->init_hash[hash] = p;
-        //printf("B3gInitHashAdd: hash %" PRIu32 ", head %p\n", hash, ctx->init_hash[hash]);
-        return 0;
-    }
-
-    B3gPattern *tt = NULL;
-    B3gPattern *t = ctx->init_hash[hash];
-
-    /* get the list tail */
-    do {
-        tt = t;
-        t = t->next;
-    } while (t != NULL);
-
-    tt->next = p;
-    //printf("B3gInitHashAdd: hash %" PRIu32 ", head %p\n", hash, ctx->init_hash[hash]);
-
-    return 0;
-}
-
-static inline int B3gCmpPattern(B3gPattern *p, uint8_t *pat, uint16_t patlen, char nocase);
-
-static inline B3gPattern *B3gInitHashLookup(B3gCtx *ctx, uint8_t *pat, uint16_t patlen, char nocase) {
-    uint32_t hash = B3gInitHashRaw(pat,patlen);
-
-    //printf("B3gInitHashLookup: %" PRIu32 ", head %p\n", hash, ctx->init_hash[hash]);
-
-    if (ctx->init_hash[hash] == NULL) {
-        return NULL;
-    }
-
-    B3gPattern *t = ctx->init_hash[hash];
-    for ( ; t != NULL; t = t->next) {
-        if (B3gCmpPattern(t,pat,patlen,nocase) == 1)
-            return t;
-    }
-
-    return NULL;
-}
-
-static inline int B3gCmpPattern(B3gPattern *p, uint8_t *pat, uint16_t patlen, char nocase) {
-    if (p->len != patlen)
-        return 0;
-
-    if (!((nocase && p->flags & B3G_NOCASE) || (!nocase && !(p->flags & B3G_NOCASE))))
-        return 0;
-
-    if (memcmp(p->cs, pat, patlen) != 0)
-        return 0;
-
-    return 1;
-}
-
 /*
  * INIT HASH END
  */
@@ -297,107 +148,6 @@ void B3gFreePattern(MpmCtx *mpm_ctx, B3gPattern *p) {
     }
 }
 
-/* B3gAddPattern
- *
- * pat: ptr to the pattern
- * patlen: length of the pattern
- * nocase: nocase flag: 1 enabled, 0 disable
- * pid: pattern id
- * sid: signature id (internal id)
- */
-static inline int B3gAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, char nocase, char scan, uint32_t pid, uint32_t sid, uint8_t nosearch) {
-    B3gCtx *ctx = (B3gCtx *)mpm_ctx->ctx;
-
-//    printf("B3gAddPattern: ctx %p \"", mpm_ctx); prt(pat, patlen);
-//    printf("\" id %" PRIu32 ", nocase %s\n", id, nocase ? "true" : "false");
-
-    if (patlen == 0)
-        return 0;
-
-    /* get a memory piece */
-    B3gPattern *p = B3gInitHashLookup(ctx, pat, patlen, nocase);
-    if (p == NULL) {
-//        printf("B3gAddPattern: allocing new pattern\n");
-        p = B3gAllocPattern(mpm_ctx);
-        if (p == NULL)
-            goto error;
-
-        p->len = patlen;
-
-        if (nocase) p->flags |= B3G_NOCASE;
-
-        /* setup the case insensitive part of the pattern */
-        p->ci = SCMalloc(patlen);
-        if (p->ci == NULL) goto error;
-        mpm_ctx->memory_cnt++;
-        mpm_ctx->memory_size += patlen;
-        memcpy_tolower(p->ci, pat, patlen);
-
-        /* setup the case sensitive part of the pattern */
-        if (p->flags & B3G_NOCASE) {
-            /* nocase means no difference between cs and ci */
-            p->cs = p->ci;
-        } else {
-            if (memcmp(p->ci,pat,p->len) == 0) {
-                /* no diff between cs and ci: pat is lowercase */
-                p->cs = p->ci;
-            } else {
-                p->cs = SCMalloc(patlen);
-                if (p->cs == NULL) goto error;
-                mpm_ctx->memory_cnt++;
-                mpm_ctx->memory_size += patlen;
-                memcpy(p->cs, pat, patlen);
-            }
-        }
-
-        //printf("B3gAddPattern: ci \""); prt(p->ci,p->len);
-        //printf("\" cs \""); prt(p->cs,p->len);
-        //printf("\" prefix_ci %" PRIu32 ", prefix_cs %" PRIu32 "\n", p->prefix_ci, p->prefix_cs);
-
-        /* put in the pattern hash */
-        B3gInitHashAdd(ctx, p);
-
-        if (mpm_ctx->pattern_cnt == 65535) {
-            printf("Max search words reached\n");
-            exit(1);
-        }
-        if (scan) mpm_ctx->scan_pattern_cnt++;
-        mpm_ctx->pattern_cnt++;
-
-        if (scan) { /* SCAN */
-            if (mpm_ctx->scan_maxlen < patlen) mpm_ctx->scan_maxlen = patlen;
-            if (mpm_ctx->scan_minlen == 0) mpm_ctx->scan_minlen = patlen;
-            else if (mpm_ctx->scan_minlen > patlen) mpm_ctx->scan_minlen = patlen;
-            p->flags |= B3G_SCAN;
-        } else { /* SEARCH */
-            if (mpm_ctx->search_maxlen < patlen) mpm_ctx->search_maxlen = patlen;
-            if (mpm_ctx->search_minlen == 0) mpm_ctx->search_minlen = patlen;
-            else if (mpm_ctx->search_minlen > patlen) mpm_ctx->search_minlen = patlen;
-        }
-    } else {
-        /* if we're reusing a pattern, check we need to check that it is a
-         * scan pattern if that is what we're adding. If so we set the pattern
-         * to be a scan pattern. */
-        if (scan) {
-            p->flags |= B3G_SCAN;
-
-            if (mpm_ctx->scan_maxlen < patlen) mpm_ctx->scan_maxlen = patlen;
-            if (mpm_ctx->scan_minlen == 0) mpm_ctx->scan_minlen = patlen;
-            else if (mpm_ctx->scan_minlen > patlen) mpm_ctx->scan_minlen = patlen;
-        }
-    }
-
-    /* we need a match */
-    B3gEndMatchAppend(mpm_ctx, p, offset, depth, pid, sid, nosearch);
-
-    mpm_ctx->total_pattern_cnt++;
-    return 0;
-
-error:
-    B3gFreePattern(mpm_ctx, p);
-    return -1;
-}
-
 int B3gAddScanPatternCI(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen,
     uint16_t offset, uint16_t depth, uint32_t pid, uint32_t sid, uint8_t nosearch)
 {
@@ -916,21 +666,6 @@ void B3gPrintSearchStats(MpmThreadCtx *mpm_thread_ctx) {
 #endif /* B3G_COUNTERS */
 }
 
-static inline int
-memcmp_lowercase(uint8_t *s1, uint8_t *s2, uint16_t n) {
-    size_t i;
-
-    /* check backwards because we already tested the first
-     * 2 to 4 chars. This way we are more likely to detect
-     * a miss and thus speed up a little... */
-    for (i = n - 1; i; i--) {
-        if (u8_tolower(*(s2+i)) != s1[i])
-            return 1;
-    }
-
-    return 0;
-}
-
 /**
  * \brief   Function to get the user defined values for b3g algorithm from the
  *          config file 'suricata.yaml'
@@ -1221,16 +956,6 @@ void B3gThreadDestroyCtx(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx) {
     MpmMatchFreeSpares(mpm_thread_ctx, mpm_thread_ctx->qlist);
 }
 
-inline uint32_t B3gScanWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) {
-    B3gCtx *ctx = (B3gCtx *)mpm_ctx->ctx;
-    return ctx->Scan(mpm_ctx, mpm_thread_ctx, pmq, buf, buflen);
-}
-
-inline uint32_t B3gSearchWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) {
-    B3gCtx *ctx = (B3gCtx *)mpm_ctx->ctx;
-    return ctx->Search(mpm_ctx, mpm_thread_ctx, pmq, buf, buflen);
-}
-
 uint32_t B3gScanBNDMq(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) {
     B3gCtx *ctx = (B3gCtx *)mpm_ctx->ctx;
 #ifdef B3G_COUNTERS
diff --git a/src/util-mpm-b3g.h b/src/util-mpm-b3g.h
index 20eed69..4eccdeb 100644
--- a/src/util-mpm-b3g.h
+++ b/src/util-mpm-b3g.h
@@ -3,10 +3,14 @@
 
 #include "util-mpm.h"
 #include "util-bloomfilter.h"
+#include "suricata.h"
+#include "suricata-common.h"
 
 #define B3G_NOCASE 0x01
 #define B3G_SCAN   0x02
 
+#define INIT_HASH_SIZE 65536
+
 //#define B3G_HASHSHIFT 8
 //#define B3G_HASHSHIFT 7
 //#define B3G_HASHSHIFT 6
@@ -123,6 +127,287 @@ typedef struct B3gThreadCtx_ {
 
 void MpmB3gRegister(void);
 
+/** ---- Inline functions ---- */
+
+static inline uint32_t B3gScanWrap(MpmCtx *, MpmThreadCtx *, PatternMatcherQueue *, uint8_t *, uint16_t);
+static inline uint32_t B3gSearchWrap(MpmCtx *, MpmThreadCtx *, PatternMatcherQueue *, uint8_t *, uint16_t);
+void B3gFreePattern(MpmCtx *, B3gPattern *);
+
+/* append an endmatch to a pattern
+ *
+ * Only used in the initialization phase */
+static inline void B3gEndMatchAppend(MpmCtx *mpm_ctx, B3gPattern *p,
+    uint16_t offset, uint16_t depth, uint32_t pid, uint32_t sid,
+    uint8_t nosearch)
+{
+    MpmEndMatch *em = MpmAllocEndMatch(mpm_ctx);
+    if (em == NULL) {
+        printf("ERROR: B3gAllocEndMatch failed\n");
+        return;
+    }
+
+    em->id = pid;
+    em->sig_id = sid;
+    em->depth = depth;
+    em->offset = offset;
+
+    if (nosearch)
+        em->flags |= MPM_ENDMATCH_NOSEARCH;
+
+    if (p->em == NULL) {
+        p->em = em;
+        return;
+    }
+
+    MpmEndMatch *m = p->em;
+    while (m->next) {
+        m = m->next;
+    }
+    m->next = em;
+}
+
+static inline B3gPattern *B3gAllocPattern(MpmCtx *mpm_ctx) {
+    B3gPattern *p = SCMalloc(sizeof(B3gPattern));
+    if (p == NULL) {
+        printf("ERROR: B3gAllocPattern: SCMalloc failed\n");
+        exit(EXIT_FAILURE);
+    }
+    memset(p,0,sizeof(B3gPattern));
+
+    mpm_ctx->memory_cnt++;
+    mpm_ctx->memory_size += sizeof(B3gPattern);
+    return p;
+}
+
+static inline B3gHashItem *
+B3gAllocHashItem(MpmCtx *mpm_ctx) {
+    B3gHashItem *hi = SCMalloc(sizeof(B3gHashItem));
+    if (hi == NULL) {
+        printf("ERROR: B3gAllocHashItem: SCMalloc failed\n");
+        exit(EXIT_FAILURE);
+    }
+    memset(hi,0,sizeof(B3gHashItem));
+
+    mpm_ctx->memory_cnt++;
+    mpm_ctx->memory_size += sizeof(B3gHashItem);
+    return hi;
+}
+
+/*
+static inline void memcpy_tolower(uint8_t *d, uint8_t *s, uint16_t len) {
+    uint16_t i;
+    for (i = 0; i < len; i++) {
+        d[i] = u8_tolower(s[i]);
+    }
+}
+*/
+
+/*
+ * INIT HASH START
+ */
+static inline uint32_t B3gInitHash(B3gPattern *p) {
+    uint32_t hash = p->len * p->cs[0];
+    if (p->len > 1)
+        hash += p->cs[1];
+
+    return (hash % INIT_HASH_SIZE);
+}
+
+static inline uint32_t B3gInitHashRaw(uint8_t *pat, uint16_t patlen) {
+    uint32_t hash = patlen * pat[0];
+    if (patlen > 1)
+        hash += pat[1];
+
+    return (hash % INIT_HASH_SIZE);
+}
+
+static inline int B3gInitHashAdd(B3gCtx *ctx, B3gPattern *p) {
+    uint32_t hash = B3gInitHash(p);
+
+    //printf("B3gInitHashAdd: %" PRIu32 "\n", hash);
+
+    if (ctx->init_hash[hash] == NULL) {
+        ctx->init_hash[hash] = p;
+        //printf("B3gInitHashAdd: hash %" PRIu32 ", head %p\n", hash, ctx->init_hash[hash]);
+        return 0;
+    }
+
+    B3gPattern *tt = NULL;
+    B3gPattern *t = ctx->init_hash[hash];
+
+    /* get the list tail */
+    do {
+        tt = t;
+        t = t->next;
+    } while (t != NULL);
+
+    tt->next = p;
+    //printf("B3gInitHashAdd: hash %" PRIu32 ", head %p\n", hash, ctx->init_hash[hash]);
+
+    return 0;
+}
+
+static inline int B3gCmpPattern(B3gPattern *p, uint8_t *pat, uint16_t patlen, char nocase);
+
+static inline B3gPattern *B3gInitHashLookup(B3gCtx *ctx, uint8_t *pat, uint16_t patlen, char nocase) {
+    uint32_t hash = B3gInitHashRaw(pat,patlen);
+
+    //printf("B3gInitHashLookup: %" PRIu32 ", head %p\n", hash, ctx->init_hash[hash]);
+
+    if (ctx->init_hash[hash] == NULL) {
+        return NULL;
+    }
+
+    B3gPattern *t = ctx->init_hash[hash];
+    for ( ; t != NULL; t = t->next) {
+        if (B3gCmpPattern(t,pat,patlen,nocase) == 1)
+            return t;
+    }
+
+    return NULL;
+}
+
+static inline int B3gCmpPattern(B3gPattern *p, uint8_t *pat, uint16_t patlen, char nocase) {
+    if (p->len != patlen)
+        return 0;
+
+    if (!((nocase && p->flags & B3G_NOCASE) || (!nocase && !(p->flags & B3G_NOCASE))))
+        return 0;
+
+    if (memcmp(p->cs, pat, patlen) != 0)
+        return 0;
+
+    return 1;
+}
+
+/* B3gAddPattern
+ *
+ * pat: ptr to the pattern
+ * patlen: length of the pattern
+ * nocase: nocase flag: 1 enabled, 0 disable
+ * pid: pattern id
+ * sid: signature id (internal id)
+ */
+static inline int B3gAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, char nocase, char scan, uint32_t pid, uint32_t sid, uint8_t nosearch) {
+    B3gCtx *ctx = (B3gCtx *)mpm_ctx->ctx;
+
+//    printf("B3gAddPattern: ctx %p \"", mpm_ctx); prt(pat, patlen);
+//    printf("\" id %" PRIu32 ", nocase %s\n", id, nocase ? "true" : "false");
+
+    if (patlen == 0)
+        return 0;
+
+    /* get a memory piece */
+    B3gPattern *p = B3gInitHashLookup(ctx, pat, patlen, nocase);
+    if (p == NULL) {
+//        printf("B3gAddPattern: allocing new pattern\n");
+        p = B3gAllocPattern(mpm_ctx);
+        if (p == NULL)
+            goto error;
+
+        p->len = patlen;
+
+        if (nocase) p->flags |= B3G_NOCASE;
+
+        /* setup the case insensitive part of the pattern */
+        p->ci = SCMalloc(patlen);
+        if (p->ci == NULL) goto error;
+        mpm_ctx->memory_cnt++;
+        mpm_ctx->memory_size += patlen;
+        memcpy_tolower(p->ci, pat, patlen);
+
+        /* setup the case sensitive part of the pattern */
+        if (p->flags & B3G_NOCASE) {
+            /* nocase means no difference between cs and ci */
+            p->cs = p->ci;
+        } else {
+            if (memcmp(p->ci,pat,p->len) == 0) {
+                /* no diff between cs and ci: pat is lowercase */
+                p->cs = p->ci;
+            } else {
+                p->cs = SCMalloc(patlen);
+                if (p->cs == NULL) goto error;
+                mpm_ctx->memory_cnt++;
+                mpm_ctx->memory_size += patlen;
+                memcpy(p->cs, pat, patlen);
+            }
+        }
+
+        //printf("B3gAddPattern: ci \""); prt(p->ci,p->len);
+        //printf("\" cs \""); prt(p->cs,p->len);
+        //printf("\" prefix_ci %" PRIu32 ", prefix_cs %" PRIu32 "\n", p->prefix_ci, p->prefix_cs);
+
+        /* put in the pattern hash */
+        B3gInitHashAdd(ctx, p);
+
+        if (mpm_ctx->pattern_cnt == 65535) {
+            printf("Max search words reached\n");
+            exit(1);
+        }
+        if (scan) mpm_ctx->scan_pattern_cnt++;
+        mpm_ctx->pattern_cnt++;
+
+        if (scan) { /* SCAN */
+            if (mpm_ctx->scan_maxlen < patlen) mpm_ctx->scan_maxlen = patlen;
+            if (mpm_ctx->scan_minlen == 0) mpm_ctx->scan_minlen = patlen;
+            else if (mpm_ctx->scan_minlen > patlen) mpm_ctx->scan_minlen = patlen;
+            p->flags |= B3G_SCAN;
+        } else { /* SEARCH */
+            if (mpm_ctx->search_maxlen < patlen) mpm_ctx->search_maxlen = patlen;
+            if (mpm_ctx->search_minlen == 0) mpm_ctx->search_minlen = patlen;
+            else if (mpm_ctx->search_minlen > patlen) mpm_ctx->search_minlen = patlen;
+        }
+    } else {
+        /* if we're reusing a pattern, check we need to check that it is a
+         * scan pattern if that is what we're adding. If so we set the pattern
+         * to be a scan pattern. */
+        if (scan) {
+            p->flags |= B3G_SCAN;
+
+            if (mpm_ctx->scan_maxlen < patlen) mpm_ctx->scan_maxlen = patlen;
+            if (mpm_ctx->scan_minlen == 0) mpm_ctx->scan_minlen = patlen;
+            else if (mpm_ctx->scan_minlen > patlen) mpm_ctx->scan_minlen = patlen;
+        }
+    }
+
+    /* we need a match */
+    B3gEndMatchAppend(mpm_ctx, p, offset, depth, pid, sid, nosearch);
+
+    mpm_ctx->total_pattern_cnt++;
+    return 0;
+
+error:
+    B3gFreePattern(mpm_ctx, p);
+    return -1;
+}
+
+/*
+static inline int
+memcmp_lowercase(uint8_t *s1, uint8_t *s2, uint16_t n) {
+    size_t i;
+
+    * check backwards because we already tested the first
+     * 2 to 4 chars. This way we are more likely to detect
+     * a miss and thus speed up a little... *
+    for (i = n - 1; i; i--) {
+        if (u8_tolower(*(s2+i)) != s1[i])
+            return 1;
+    }
+
+    return 0;
+}
+*/
+
+static inline uint32_t B3gScanWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) {
+    B3gCtx *ctx = (B3gCtx *)mpm_ctx->ctx;
+    return ctx->Scan(mpm_ctx, mpm_thread_ctx, pmq, buf, buflen);
+}
+
+static inline uint32_t B3gSearchWrap(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) {
+    B3gCtx *ctx = (B3gCtx *)mpm_ctx->ctx;
+    return ctx->Search(mpm_ctx, mpm_thread_ctx, pmq, buf, buflen);
+}
+
 
 #endif
 
diff --git a/src/util-mpm-wumanber.c b/src/util-mpm-wumanber.c
index b735bdc..777589d 100644
--- a/src/util-mpm-wumanber.c
+++ b/src/util-mpm-wumanber.c
@@ -24,8 +24,6 @@
 #include "util-unittest.h"
 #include "util-debug.h"
 
-#define INIT_HASH_SIZE 65535
-
 #define HASH16_SIZE 65536
 #define HASH16(a,b) (((a)<<8) | (b))
 #define HASH15_SIZE 32768
@@ -49,8 +47,6 @@ int WmAddScanPatternCS(MpmCtx *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32
 int WmAddPatternCI(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, uint32_t sid);
 int WmAddPatternCS(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, uint32_t sid);
 int WmPreparePatterns(MpmCtx *mpm_ctx);
-inline uint32_t WmScan(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *, uint8_t *buf, uint16_t buflen);
-inline uint32_t WmSearch(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *, uint8_t *buf, uint16_t buflen);
 uint32_t WmScan1(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *, uint8_t *buf, uint16_t buflen);
 uint32_t WmScan2Hash9(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *, uint8_t *buf, uint16_t buflen);
 uint32_t WmScan2Hash12(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *, uint8_t *buf, uint16_t buflen);
@@ -108,39 +104,6 @@ void MpmWuManberRegister (void) {
     }
 }
 
-/* append an endmatch to a pattern
- *
- * Only used in the initialization phase */
-static inline void WmEndMatchAppend(MpmCtx *mpm_ctx, WmPattern *p,
-    uint16_t offset, uint16_t depth, uint32_t pid, uint32_t sid,
-    uint8_t nosearch)
-{
-    MpmEndMatch *em = MpmAllocEndMatch(mpm_ctx);
-    if (em == NULL) {
-        printf("ERROR: WmAllocEndMatch failed\n");
-        return;
-    }
-
-    em->id = pid;
-    em->sig_id = sid;
-    em->depth = depth;
-    em->offset = offset;
-
-    if (nosearch)
-        em->flags |= MPM_ENDMATCH_NOSEARCH;
-
-    if (p->em == NULL) {
-        p->em = em;
-        return;
-    }
-
-    MpmEndMatch *m = p->em;
-    while (m->next) {
-        m = m->next;
-    }
-    m->next = em;
-}
-
 void prt (uint8_t *buf, uint16_t buflen) {
     uint16_t i;
 
@@ -208,33 +171,6 @@ void WmPrintInfo(MpmCtx *mpm_ctx) {
     printf("\n");
 }
 
-static inline WmPattern *WmAllocPattern(MpmCtx *mpm_ctx) {
-    WmPattern *p = SCMalloc(sizeof(WmPattern));
-    if (p == NULL) {
-        printf("ERROR: WmAllocPattern: SCMalloc failed\n");
-        exit(EXIT_FAILURE);
-    }
-    memset(p,0,sizeof(WmPattern));
-
-    mpm_ctx->memory_cnt++;
-    mpm_ctx->memory_size += sizeof(WmPattern);
-    return p;
-}
-
-static inline WmHashItem *
-WmAllocHashItem(MpmCtx *mpm_ctx) {
-    WmHashItem *hi = SCMalloc(sizeof(WmHashItem));
-    if (hi == NULL) {
-        printf("ERROR: WmAllocHashItem: SCMalloc failed\n");
-        exit(EXIT_FAILURE);
-    }
-    memset(hi,0,sizeof(WmHashItem));
-
-    mpm_ctx->memory_cnt++;
-    mpm_ctx->memory_size += sizeof(WmHashItem);
-    return hi;
-}
-
 static void WmHashFree(MpmCtx *mpm_ctx, WmHashItem *hi) {
     if (hi == NULL)
         return;
@@ -247,95 +183,6 @@ static void WmHashFree(MpmCtx *mpm_ctx, WmHashItem *hi) {
     SCFree(hi);
 }
 
-static inline void memcpy_tolower(uint8_t *d, uint8_t *s, uint16_t len) {
-    uint16_t i;
-    for (i = 0; i < len; i++) {
-        d[i] = wm_tolower(s[i]);
-    }
-}
-
-/*
- * INIT HASH START
- */
-static inline uint32_t WmInitHash(WmPattern *p) {
-    uint32_t hash = p->len * p->cs[0];
-    if (p->len > 1)
-        hash += p->cs[1];
-
-    return (hash % INIT_HASH_SIZE);
-}
-
-static inline uint32_t WmInitHashRaw(uint8_t *pat, uint16_t patlen) {
-    uint32_t hash = patlen * pat[0];
-    if (patlen > 1)
-        hash += pat[1];
-
-    return (hash % INIT_HASH_SIZE);
-}
-
-static inline int WmInitHashAdd(WmCtx *ctx, WmPattern *p) {
-    uint32_t hash = WmInitHash(p);
-
-    //printf("WmInitHashAdd: %" PRIu32 "\n", hash);
-
-    if (ctx->init_hash[hash] == NULL) {
-        ctx->init_hash[hash] = p;
-        //printf("WmInitHashAdd: hash %" PRIu32 ", head %p\n", hash, ctx->init_hash[hash]);
-        return 0;
-    }
-
-    WmPattern *tt = NULL;
-    WmPattern *t = ctx->init_hash[hash];
-
-    /* get the list tail */
-    do {
-        tt = t;
-        t = t->next;
-    } while (t != NULL);
-
-    tt->next = p;
-    //printf("WmInitHashAdd: hash %" PRIu32 ", head %p\n", hash, ctx->init_hash[hash]);
-
-    return 0;
-}
-
-static inline int WmCmpPattern(WmPattern *p, uint8_t *pat, uint16_t patlen, char nocase);
-
-static inline WmPattern *WmInitHashLookup(WmCtx *ctx, uint8_t *pat, uint16_t patlen, char nocase) {
-    uint32_t hash = WmInitHashRaw(pat,patlen);
-
-    //printf("WmInitHashLookup: %" PRIu32 ", head %p\n", hash, ctx->init_hash[hash]);
-
-    if (ctx->init_hash[hash] == NULL) {
-        return NULL;
-    }
-
-    WmPattern *t = ctx->init_hash[hash];
-    for ( ; t != NULL; t = t->next) {
-        if (WmCmpPattern(t,pat,patlen,nocase) == 1)
-            return t;
-    }
-
-    return NULL;
-}
-
-static inline int WmCmpPattern(WmPattern *p, uint8_t *pat, uint16_t patlen, char nocase) {
-    if (p->len != patlen)
-        return 0;
-
-    if (!((nocase && p->flags & WUMANBER_NOCASE) || (!nocase && !(p->flags & WUMANBER_NOCASE))))
-        return 0;
-
-    if (memcmp(p->cs, pat, patlen) != 0)
-        return 0;
-
-    return 1;
-}
-
-/*
- * INIT HASH END
- */
-
 void WmFreePattern(MpmCtx *mpm_ctx, WmPattern *p) {
     if (p && p->em) {
         MpmEndMatchFreeAll(mpm_ctx, p->em);
@@ -360,110 +207,6 @@ void WmFreePattern(MpmCtx *mpm_ctx, WmPattern *p) {
     }
 }
 
-/* WmAddPattern
- *
- * pat: ptr to the pattern
- * patlen: length of the pattern
- * nocase: nocase flag: 1 enabled, 0 disable
- * pid: pattern id
- * sid: signature id (internal id)
- */
-static inline int WmAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, char nocase, char scan, uint32_t pid, uint32_t sid, uint8_t nosearch) {
-    WmCtx *ctx = (WmCtx *)mpm_ctx->ctx;
-
-//    printf("WmAddPattern: ctx %p \"", mpm_ctx); prt(pat, patlen);
-//    printf("\" id %" PRIu32 ", nocase %s\n", id, nocase ? "true" : "false");
-
-    if (patlen == 0)
-        return 0;
-
-    /* get a memory piece */
-    WmPattern *p = WmInitHashLookup(ctx, pat, patlen, nocase);
-    if (p == NULL) {
-//        printf("WmAddPattern: allocing new pattern\n");
-        p = WmAllocPattern(mpm_ctx);
-        if (p == NULL)
-            goto error;
-
-        p->len = patlen;
-
-        if (nocase) p->flags |= WUMANBER_NOCASE;
-
-        /* setup the case insensitive part of the pattern */
-        p->ci = SCMalloc(patlen);
-        if (p->ci == NULL) goto error;
-        mpm_ctx->memory_cnt++;
-        mpm_ctx->memory_size += patlen;
-        memcpy_tolower(p->ci, pat, patlen);
-
-        /* setup the case sensitive part of the pattern */
-        if (p->flags & WUMANBER_NOCASE) {
-            /* nocase means no difference between cs and ci */
-            p->cs = p->ci;
-        } else {
-            if (memcmp(p->ci,pat,p->len) == 0) {
-                /* no diff between cs and ci: pat is lowercase */
-                p->cs = p->ci;
-            } else {
-                p->cs = SCMalloc(patlen);
-                if (p->cs == NULL) goto error;
-                mpm_ctx->memory_cnt++;
-                mpm_ctx->memory_size += patlen;
-                memcpy(p->cs, pat, patlen);
-            }
-        }
-
-        if (p->len > 1) {
-            p->prefix_cs = (uint16_t)(*(p->cs)+*(p->cs+1));
-            p->prefix_ci = (uint16_t)(*(p->ci)+*(p->ci+1));
-        }
-
-        //printf("WmAddPattern: ci \""); prt(p->ci,p->len);
-        //printf("\" cs \""); prt(p->cs,p->len);
-        //printf("\" prefix_ci %" PRIu32 ", prefix_cs %" PRIu32 "\n", p->prefix_ci, p->prefix_cs);
-
-        /* put in the pattern hash */
-        WmInitHashAdd(ctx, p);
-
-        if (mpm_ctx->pattern_cnt == 65535) {
-            printf("Max search words reached\n");
-            exit(1);
-        }
-        mpm_ctx->pattern_cnt++;
-
-        if (scan) { /* SCAN */
-            if (mpm_ctx->scan_maxlen < patlen) mpm_ctx->scan_maxlen = patlen;
-            if (mpm_ctx->scan_minlen == 0) mpm_ctx->scan_minlen = patlen;
-            else if (mpm_ctx->scan_minlen > patlen) mpm_ctx->scan_minlen = patlen;
-            p->flags |= WUMANBER_SCAN;
-        } else { /* SEARCH */
-            if (mpm_ctx->search_maxlen < patlen) mpm_ctx->search_maxlen = patlen;
-            if (mpm_ctx->search_minlen == 0) mpm_ctx->search_minlen = patlen;
-            else if (mpm_ctx->search_minlen > patlen) mpm_ctx->search_minlen = patlen;
-        }
-    } else {
-        /* if we're reusing a pattern, check we need to check that it is a
-         * scan pattern if that is what we're adding. If so we set the pattern
-         * to be a scan pattern. */
-        if (scan) {
-            p->flags = WUMANBER_SCAN;
-            if (mpm_ctx->scan_maxlen < patlen) mpm_ctx->scan_maxlen = patlen;
-            if (mpm_ctx->scan_minlen == 0) mpm_ctx->scan_minlen = patlen;
-            else if (mpm_ctx->scan_minlen > patlen) mpm_ctx->scan_minlen = patlen;
-        }
-    }
-
-    /* we need a match */
-    WmEndMatchAppend(mpm_ctx, p, offset, depth, pid, sid, nosearch);
-
-    mpm_ctx->total_pattern_cnt++;
-    return 0;
-
-error:
-    WmFreePattern(mpm_ctx, p);
-    return -1;
-}
-
 int WmAddScanPatternCI(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen,
     uint16_t offset, uint16_t depth, uint32_t pid, uint32_t sid, uint8_t nosearch)
 {
@@ -900,7 +643,7 @@ int WmPreparePatterns(MpmCtx *mpm_ctx) {
 
     /* populate it with the patterns in the hash */
     uint32_t i = 0, p = 0;
-    for (i = 0; i < INIT_HASH_SIZE; i++) {
+    for (i = 0; i < WM_INIT_HASH_SIZE; i++) {
         WmPattern *node = ctx->init_hash[i], *nnode = NULL;
         for ( ; node != NULL; ) {
             nnode = node->next;
@@ -1022,31 +765,6 @@ void WmPrintSearchStats(MpmThreadCtx *mpm_thread_ctx) {
 #endif /* WUMANBER_COUNTERS */
 }
 
-static inline int
-memcmp_lowercase(uint8_t *s1, uint8_t *s2, uint16_t n) {
-    size_t i;
-
-    /* check backwards because we already tested the first
-     * 2 to 4 chars. This way we are more likely to detect
-     * a miss and thus speed up a little... */
-    for (i = n - 1; i; i--) {
-        if (wm_tolower(*(s2+i)) != s1[i])
-            return 1;
-    }
-
-    return 0;
-}
-
-inline uint32_t WmScan(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) {
-    WmCtx *ctx = (WmCtx *)mpm_ctx->ctx;
-    return ctx->Scan(mpm_ctx, mpm_thread_ctx, pmq, buf, buflen);
-}
-
-inline uint32_t WmSearch(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) {
-    WmCtx *ctx = (WmCtx *)mpm_ctx->ctx;
-    return ctx->Search(mpm_ctx, mpm_thread_ctx, pmq, buf, buflen);
-}
-
 /* SCAN FUNCTIONS */
 uint32_t WmScan2Hash9(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) {
     WmCtx *ctx = (WmCtx *)mpm_ctx->ctx;
@@ -2244,11 +1962,11 @@ void WmInitCtx (MpmCtx *mpm_ctx, int module_handle) {
 
     /* initialize the hash we use to speed up pattern insertions */
     WmCtx *ctx = (WmCtx *)mpm_ctx->ctx;
-    ctx->init_hash = SCMalloc(sizeof(WmPattern *) * INIT_HASH_SIZE);
+    ctx->init_hash = SCMalloc(sizeof(WmPattern *) * WM_INIT_HASH_SIZE);
     if (ctx->init_hash == NULL)
         return;
 
-    memset(ctx->init_hash, 0, sizeof(WmPattern *) * INIT_HASH_SIZE);
+    memset(ctx->init_hash, 0, sizeof(WmPattern *) * WM_INIT_HASH_SIZE);
 
     /* Initialize the defaults value from the config file. The given check make
        sure that we query config file only once for config values */
@@ -2265,7 +1983,7 @@ void WmDestroyCtx(MpmCtx *mpm_ctx) {
     if (ctx->init_hash) {
         SCFree(ctx->init_hash);
         mpm_ctx->memory_cnt--;
-        mpm_ctx->memory_size -= (INIT_HASH_SIZE * sizeof(WmPattern *));
+        mpm_ctx->memory_size -= (WM_INIT_HASH_SIZE * sizeof(WmPattern *));
     }
 
     if (ctx->parray) {
diff --git a/src/util-mpm-wumanber.h b/src/util-mpm-wumanber.h
index edbd66a..660058f 100644
--- a/src/util-mpm-wumanber.h
+++ b/src/util-mpm-wumanber.h
@@ -11,6 +11,9 @@
 
 //#define WUMANBER_COUNTERS
 
+#define WM_INIT_HASH_SIZE 65535
+
+
 typedef struct WmPattern_ {
     uint8_t *cs; /* case sensitive */
     uint8_t *ci; /* case INsensitive */
@@ -84,6 +87,263 @@ typedef struct WmThreadCtx_ {
 } WmThreadCtx;
 
 void MpmWuManberRegister(void);
+void WmFreePattern(MpmCtx *, WmPattern *);
+
+/** ---- Inline functions ---- */
+
+static inline uint32_t WmScan(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *, uint8_t *buf, uint16_t buflen);
+static inline uint32_t WmSearch(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *, uint8_t *buf, uint16_t buflen);
+
+/* append an endmatch to a pattern
+ *
+ * Only used in the initialization phase */
+static inline void WmEndMatchAppend(MpmCtx *mpm_ctx, WmPattern *p,
+    uint16_t offset, uint16_t depth, uint32_t pid, uint32_t sid,
+    uint8_t nosearch)
+{
+    MpmEndMatch *em = MpmAllocEndMatch(mpm_ctx);
+    if (em == NULL) {
+        printf("ERROR: WmAllocEndMatch failed\n");
+        return;
+    }
+
+    em->id = pid;
+    em->sig_id = sid;
+    em->depth = depth;
+    em->offset = offset;
+
+    if (nosearch)
+        em->flags |= MPM_ENDMATCH_NOSEARCH;
+
+    if (p->em == NULL) {
+        p->em = em;
+        return;
+    }
+
+    MpmEndMatch *m = p->em;
+    while (m->next) {
+        m = m->next;
+    }
+    m->next = em;
+}
+
+static inline WmPattern *WmAllocPattern(MpmCtx *mpm_ctx) {
+    WmPattern *p = SCMalloc(sizeof(WmPattern));
+    if (p == NULL) {
+        printf("ERROR: WmAllocPattern: SCMalloc failed\n");
+        exit(EXIT_FAILURE);
+    }
+    memset(p,0,sizeof(WmPattern));
+
+    mpm_ctx->memory_cnt++;
+    mpm_ctx->memory_size += sizeof(WmPattern);
+    return p;
+}
+
+
+static inline WmHashItem *
+WmAllocHashItem(MpmCtx *mpm_ctx) {
+    WmHashItem *hi = SCMalloc(sizeof(WmHashItem));
+    if (hi == NULL) {
+        printf("ERROR: WmAllocHashItem: SCMalloc failed\n");
+        exit(EXIT_FAILURE);
+    }
+    memset(hi,0,sizeof(WmHashItem));
+
+    mpm_ctx->memory_cnt++;
+    mpm_ctx->memory_size += sizeof(WmHashItem);
+    return hi;
+}
+
+static inline uint32_t WmInitHash(WmPattern *p) {
+    uint32_t hash = p->len * p->cs[0];
+    if (p->len > 1)
+        hash += p->cs[1];
+
+    return (hash % WM_INIT_HASH_SIZE);
+}
+
+static inline uint32_t WmInitHashRaw(uint8_t *pat, uint16_t patlen) {
+    uint32_t hash = patlen * pat[0];
+    if (patlen > 1)
+        hash += pat[1];
+
+    return (hash % WM_INIT_HASH_SIZE);
+}
+
+static inline int WmInitHashAdd(WmCtx *ctx, WmPattern *p) {
+    uint32_t hash = WmInitHash(p);
+
+    //printf("WmInitHashAdd: %" PRIu32 "\n", hash);
+
+    if (ctx->init_hash[hash] == NULL) {
+        ctx->init_hash[hash] = p;
+        //printf("WmInitHashAdd: hash %" PRIu32 ", head %p\n", hash, ctx->init_hash[hash]);
+        return 0;
+    }
+
+    WmPattern *tt = NULL;
+    WmPattern *t = ctx->init_hash[hash];
+
+    /* get the list tail */
+    do {
+        tt = t;
+        t = t->next;
+    } while (t != NULL);
+
+    tt->next = p;
+    //printf("WmInitHashAdd: hash %" PRIu32 ", head %p\n", hash, ctx->init_hash[hash]);
+
+    return 0;
+}
+
+static inline int WmCmpPattern(WmPattern *p, uint8_t *pat, uint16_t patlen, char nocase);
+
+static inline WmPattern *WmInitHashLookup(WmCtx *ctx, uint8_t *pat, uint16_t patlen, char nocase) {
+    uint32_t hash = WmInitHashRaw(pat,patlen);
+
+    //printf("WmInitHashLookup: %" PRIu32 ", head %p\n", hash, ctx->init_hash[hash]);
+
+    if (ctx->init_hash[hash] == NULL) {
+        return NULL;
+    }
+
+    WmPattern *t = ctx->init_hash[hash];
+    for ( ; t != NULL; t = t->next) {
+        if (WmCmpPattern(t,pat,patlen,nocase) == 1)
+            return t;
+    }
+
+    return NULL;
+}
+
+static inline int WmCmpPattern(WmPattern *p, uint8_t *pat, uint16_t patlen, char nocase) {
+    if (p->len != patlen)
+        return 0;
+
+    if (!((nocase && p->flags & WUMANBER_NOCASE) || (!nocase && !(p->flags & WUMANBER_NOCASE))))
+        return 0;
+
+    if (memcmp(p->cs, pat, patlen) != 0)
+        return 0;
+
+    return 1;
+}
+
+/* WmAddPattern
+ *
+ * pat: ptr to the pattern
+ * patlen: length of the pattern
+ * nocase: nocase flag: 1 enabled, 0 disable
+ * pid: pattern id
+ * sid: signature id (internal id)
+ */
+static inline int WmAddPattern(MpmCtx *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, char nocase, char scan, uint32_t pid, uint32_t sid, uint8_t nosearch) {
+    WmCtx *ctx = (WmCtx *)mpm_ctx->ctx;
+
+//    printf("WmAddPattern: ctx %p \"", mpm_ctx); prt(pat, patlen);
+//    printf("\" id %" PRIu32 ", nocase %s\n", id, nocase ? "true" : "false");
+
+    if (patlen == 0)
+        return 0;
+
+    /* get a memory piece */
+    WmPattern *p = WmInitHashLookup(ctx, pat, patlen, nocase);
+    if (p == NULL) {
+//        printf("WmAddPattern: allocing new pattern\n");
+        p = WmAllocPattern(mpm_ctx);
+        if (p == NULL)
+            goto error;
+
+        p->len = patlen;
+
+        if (nocase) p->flags |= WUMANBER_NOCASE;
+
+        /* setup the case insensitive part of the pattern */
+        p->ci = SCMalloc(patlen);
+        if (p->ci == NULL) goto error;
+        mpm_ctx->memory_cnt++;
+        mpm_ctx->memory_size += patlen;
+        memcpy_tolower(p->ci, pat, patlen);
+
+        /* setup the case sensitive part of the pattern */
+        if (p->flags & WUMANBER_NOCASE) {
+            /* nocase means no difference between cs and ci */
+            p->cs = p->ci;
+        } else {
+            if (memcmp(p->ci,pat,p->len) == 0) {
+                /* no diff between cs and ci: pat is lowercase */
+                p->cs = p->ci;
+            } else {
+                p->cs = SCMalloc(patlen);
+                if (p->cs == NULL) goto error;
+                mpm_ctx->memory_cnt++;
+                mpm_ctx->memory_size += patlen;
+                memcpy(p->cs, pat, patlen);
+            }
+        }
+
+        if (p->len > 1) {
+            p->prefix_cs = (uint16_t)(*(p->cs)+*(p->cs+1));
+            p->prefix_ci = (uint16_t)(*(p->ci)+*(p->ci+1));
+        }
+
+        //printf("WmAddPattern: ci \""); prt(p->ci,p->len);
+        //printf("\" cs \""); prt(p->cs,p->len);
+        //printf("\" prefix_ci %" PRIu32 ", prefix_cs %" PRIu32 "\n", p->prefix_ci, p->prefix_cs);
+
+        /* put in the pattern hash */
+        WmInitHashAdd(ctx, p);
+
+        if (mpm_ctx->pattern_cnt == 65535) {
+            printf("Max search words reached\n");
+            exit(1);
+        }
+        mpm_ctx->pattern_cnt++;
+
+        if (scan) { /* SCAN */
+            if (mpm_ctx->scan_maxlen < patlen) mpm_ctx->scan_maxlen = patlen;
+            if (mpm_ctx->scan_minlen == 0) mpm_ctx->scan_minlen = patlen;
+            else if (mpm_ctx->scan_minlen > patlen) mpm_ctx->scan_minlen = patlen;
+            p->flags |= WUMANBER_SCAN;
+        } else { /* SEARCH */
+            if (mpm_ctx->search_maxlen < patlen) mpm_ctx->search_maxlen = patlen;
+            if (mpm_ctx->search_minlen == 0) mpm_ctx->search_minlen = patlen;
+            else if (mpm_ctx->search_minlen > patlen) mpm_ctx->search_minlen = patlen;
+        }
+    } else {
+        /* if we're reusing a pattern, check we need to check that it is a
+         * scan pattern if that is what we're adding. If so we set the pattern
+         * to be a scan pattern. */
+        if (scan) {
+            p->flags = WUMANBER_SCAN;
+            if (mpm_ctx->scan_maxlen < patlen) mpm_ctx->scan_maxlen = patlen;
+            if (mpm_ctx->scan_minlen == 0) mpm_ctx->scan_minlen = patlen;
+            else if (mpm_ctx->scan_minlen > patlen) mpm_ctx->scan_minlen = patlen;
+        }
+    }
+
+    /* we need a match */
+    WmEndMatchAppend(mpm_ctx, p, offset, depth, pid, sid, nosearch);
+
+    mpm_ctx->total_pattern_cnt++;
+    return 0;
+
+error:
+    WmFreePattern(mpm_ctx, p);
+    return -1;
+}
+
+static inline uint32_t WmScan(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) {
+    WmCtx *ctx = (WmCtx *)mpm_ctx->ctx;
+    return ctx->Scan(mpm_ctx, mpm_thread_ctx, pmq, buf, buflen);
+}
+
+static inline uint32_t WmSearch(MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx, PatternMatcherQueue *pmq, uint8_t *buf, uint16_t buflen) {
+    WmCtx *ctx = (WmCtx *)mpm_ctx->ctx;
+    return ctx->Search(mpm_ctx, mpm_thread_ctx, pmq, buf, buflen);
+}
+
 
 #endif /* __UTIL_MPM_WUMANBER_H__ */
 
diff --git a/src/util-mpm.c b/src/util-mpm.c
index 2252945..1c82e8b 100644
--- a/src/util-mpm.c
+++ b/src/util-mpm.c
@@ -123,111 +123,6 @@ MpmMatchCleanup(MpmThreadCtx *thread_ctx) {
     }
 }
 
-/** \brief allocate a match
- *
- * used at search runtime */
-inline MpmMatch *
-MpmMatchAlloc(MpmThreadCtx *thread_ctx) {
-    MpmMatch *m = SCMalloc(sizeof(MpmMatch));
-    if (m == NULL)
-        return NULL;
-
-    thread_ctx->memory_cnt++;
-    thread_ctx->memory_size += sizeof(MpmMatch);
-
-    m->offset = 0;
-    m->next = NULL;
-    m->qnext = NULL;
-    m->mb = NULL;
-    return m;
-}
-
-/** \brief append a match to a bucket
- *
- * used at search runtime */
-inline int
-MpmMatchAppend(MpmThreadCtx *thread_ctx, PatternMatcherQueue *pmq, MpmEndMatch *em, MpmMatchBucket *mb, uint16_t offset, uint16_t patlen)
-{
-    /* don't bother looking at sigs that didn't match
-     * when we scanned. There's no matching anyway. */
-    if (pmq != NULL && pmq->mode == PMQ_MODE_SEARCH) {
-        if (!(pmq->sig_bitarray[(em->sig_id / 8)] & (1<<(em->sig_id % 8))))
-            return 0;
-    }
-
-    /* if our endmatch is set to a single match being enough,
-       we're not going to add more if we already have one */
-    if (em->flags & MPM_ENDMATCH_SINGLE && mb->len)
-        return 0;
-
-    /* check offset */
-    if (offset < em->offset)
-        return 0;
-
-    /* check depth */
-    if (em->depth && (offset+patlen) > em->depth)
-        return 0;
-
-    /* ok all checks passed, now append the match */
-    MpmMatch *m;
-    /* pull a match from the spare list */
-    if (thread_ctx->sparelist != NULL) {
-        m = thread_ctx->sparelist;
-        thread_ctx->sparelist = m->qnext;
-    } else {
-        m = MpmMatchAlloc(thread_ctx);
-        if (m == NULL)
-            return 0;
-    }
-
-    m->offset = offset;
-    m->mb = mb;
-    m->next = NULL;
-    m->qnext = NULL;
-
-    /* append to the mb list */
-    if (mb->bot == NULL) { /* empty list */
-        mb->top = m;
-        mb->bot = m;
-    } else { /* more items in list */
-        mb->bot->next = m;
-        mb->bot = m;
-    }
-
-    mb->len++;
-
-    /* put in the queue list */
-    if (thread_ctx->qlist == NULL) { /* empty list */
-        thread_ctx->qlist = m;
-    } else { /* more items in list */
-        m->qnext = thread_ctx->qlist;
-        thread_ctx->qlist = m;
-    }
-
-    BUG_ON(m == m->qnext);
-
-    if (pmq != NULL) {
-        /* make sure we only append a sig with a matching pattern once,
-         * so we won't inspect it more than once. For this we keep a
-         * bitarray of sig internal id's and flag each sig that matched */
-        if (!(pmq->sig_bitarray[(em->sig_id / 8)] & (1<<(em->sig_id % 8)))) {
-            /* flag this sig_id as being added now */
-            pmq->sig_bitarray[(em->sig_id / 8)] |= (1<<(em->sig_id % 8));
-            /* append the sig_id to the array with matches */
-            pmq->sig_id_array[pmq->sig_id_array_cnt] = em->sig_id;
-            pmq->sig_id_array_cnt++;
-        }
-
-        /* nosearch flag */
-        if (pmq->mode == PMQ_MODE_SCAN && !(em->flags & MPM_ENDMATCH_NOSEARCH)) {
-            pmq->searchable++;
-        }
-    }
-
-    SCLogDebug("len %" PRIu32 " (offset %" PRIu32 ")", mb->len, m->offset);
-    return 1;
-}
-
 void MpmMatchFree(MpmThreadCtx *ctx, MpmMatch *m) {
     ctx->memory_cnt--;
     ctx->memory_size -= sizeof(MpmMatch);
diff --git a/src/util-mpm.h b/src/util-mpm.h
index 92d23f0..952ee66 100644
--- a/src/util-mpm.h
+++ b/src/util-mpm.h
@@ -147,8 +147,6 @@ void PmqCleanup(PatternMatcherQueue *);
 void PmqFree(PatternMatcherQueue *);
 
 void MpmMatchCleanup(MpmThreadCtx *);
-MpmMatch *MpmMatchAlloc(MpmThreadCtx *);
-int MpmMatchAppend(MpmThreadCtx *, PatternMatcherQueue *, MpmEndMatch *, MpmMatchBucket *, uint16_t, uint16_t);
 MpmEndMatch *MpmAllocEndMatch (MpmCtx *);
 void MpmEndMatchFreeAll(MpmCtx *mpm_ctx, MpmEndMatch *em);
 void MpmMatchFreeSpares(MpmThreadCtx *mpm_ctx, MpmMatch *m);
@@ -164,5 +162,114 @@ void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t, uint32_t);
 uint32_t MpmGetHashSize(const char *);
 uint32_t MpmGetBloomSize(const char *);
 
+/** ------ Inline functions ------- */
+
+static inline MpmMatch *MpmMatchAlloc(MpmThreadCtx *);
+static inline int MpmMatchAppend(MpmThreadCtx *, PatternMatcherQueue *, MpmEndMatch *, MpmMatchBucket *, uint16_t, uint16_t);
+
+/** \brief allocate a match
+ *
+ * used at search runtime */
+static inline MpmMatch *
+MpmMatchAlloc(MpmThreadCtx *thread_ctx) {
+    MpmMatch *m = SCMalloc(sizeof(MpmMatch));
+    if (m == NULL)
+        return NULL;
+
+    thread_ctx->memory_cnt++;
+    thread_ctx->memory_size += sizeof(MpmMatch);
+
+    m->offset = 0;
+    m->next = NULL;
+    m->qnext = NULL;
+    m->mb = NULL;
+    return m;
+}
+
+/** \brief append a match to a bucket
+ *
+ * used at search runtime */
+static inline int
+MpmMatchAppend(MpmThreadCtx *thread_ctx, PatternMatcherQueue *pmq, MpmEndMatch *em, MpmMatchBucket *mb, uint16_t offset, uint16_t patlen)
+{
+    /* don't bother looking at sigs that didn't match
+     * when we scanned. There's no matching anyway. */
+    if (pmq != NULL && pmq->mode == PMQ_MODE_SEARCH) {
+        if (!(pmq->sig_bitarray[(em->sig_id / 8)] & (1<<(em->sig_id % 8))))
+            return 0;
+    }
+
+    /* if our endmatch is set to a single match being enough,
+       we're not going to add more if we already have one */
+    if (em->flags & MPM_ENDMATCH_SINGLE && mb->len)
+        return 0;
+
+    /* check offset */
+    if (offset < em->offset)
+        return 0;
+
+    /* check depth */
+    if (em->depth && (offset+patlen) > em->depth)
+        return 0;
+
+    /* ok all checks passed, now append the match */
+    MpmMatch *m;
+    /* pull a match from the spare list */
+    if (thread_ctx->sparelist != NULL) {
+        m = thread_ctx->sparelist;
+        thread_ctx->sparelist = m->qnext;
+    } else {
+        m = MpmMatchAlloc(thread_ctx);
+        if (m == NULL)
+            return 0;
+    }
+
+    m->offset = offset;
+    m->mb = mb;
+    m->next = NULL;
+    m->qnext = NULL;
+
+    /* append to the mb list */
+    if (mb->bot == NULL) { /* empty list */
+        mb->top = m;
+        mb->bot = m;
+    } else { /* more items in list */
+        mb->bot->next = m;
+        mb->bot = m;
+    }
+
+    mb->len++;
+
+    /* put in the queue list */
+    if (thread_ctx->qlist == NULL) { /* empty list */
+        thread_ctx->qlist = m;
+    } else { /* more items in list */
+        m->qnext = thread_ctx->qlist;
+        thread_ctx->qlist = m;
+    }
+
+    BUG_ON(m == m->qnext);
+
+    if (pmq != NULL) {
+        /* make sure we only append a sig with a matching pattern once,
+         * so we won't inspect it more than once. For this we keep a
+         * bitarray of sig internal id's and flag each sig that matched */
+        if (!(pmq->sig_bitarray[(em->sig_id / 8)] & (1<<(em->sig_id % 8)))) {
+            /* flag this sig_id as being added now */
+            pmq->sig_bitarray[(em->sig_id / 8)] |= (1<<(em->sig_id % 8));
+            /* append the sig_id to the array with matches */
+            pmq->sig_id_array[pmq->sig_id_array_cnt] = em->sig_id;
+            pmq->sig_id_array_cnt++;
+        }
+
+        /* nosearch flag */
+        if (pmq->mode == PMQ_MODE_SCAN && !(em->flags & MPM_ENDMATCH_NOSEARCH)) {
+            pmq->searchable++;
+        }
+    }
+
+    SCLogDebug("len %" PRIu32 " (offset %" PRIu32 ")", mb->len, m->offset);
+    return 1;
+}
 #endif /* __UTIL_MPM_H__ */
 
diff --git a/src/util-radix-tree.c b/src/util-radix-tree.c
index 61849b3..53313b0 100644
--- a/src/util-radix-tree.c
+++ b/src/util-radix-tree.c
@@ -366,7 +366,7 @@ static int SCRadixPrefixNetmaskCount(SCRadixPrefix *prefix)
  * \retval 1 On match.
  * \retval 0 On no match.
  */
-static int SCRadixPrefixContainNetmaskAndSetUserData(SCRadixPrefix *prefix,
+int SCRadixPrefixContainNetmaskAndSetUserData(SCRadixPrefix *prefix,
                                                      uint16_t bitlen,
                                                      int exact_match)
 {
@@ -418,7 +418,7 @@ static int SCRadixPrefixContainNetmaskAndSetUserData(SCRadixPrefix *prefix,
  * \param prefix Pointer to a prefix instance
  * \param tree   Pointer to the Radix tree to which this prefix belongs
  */
-static void SCRadixReleasePrefix(SCRadixPrefix *prefix, SCRadixTree *tree)
+void SCRadixReleasePrefix(SCRadixPrefix *prefix, SCRadixTree *tree)
 {
     SCRadixUserData *user_data_temp1 = NULL;
     SCRadixUserData *user_data_temp2 = NULL;
@@ -445,40 +445,6 @@ static void SCRadixReleasePrefix(SCRadixPrefix *prefix, SCRadixTree *tree)
 }
 
 /**
- * \brief Creates a new node for the Radix tree
- *
- * \retval node The newly created node for the radix tree
- */
-static inline SCRadixNode *SCRadixCreateNode()
-{
-    SCRadixNode *node = NULL;
-
-    if ( (node = SCMalloc(sizeof(SCRadixNode))) == NULL) {
-        SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory");
-        exit(EXIT_FAILURE);
-    }
-    memset(node, 0, sizeof(SCRadixNode));
-
-    return node;
-}
-
-/**
- * \brief Frees a Radix tree node
- *
- * \param node Pointer to a Radix tree node
- * \param tree Pointer to the Radix tree to which this node belongs
- */
-static inline void SCRadixReleaseNode(SCRadixNode *node, SCRadixTree *tree)
-{
-    if (node != NULL) {
-        SCRadixReleasePrefix(node->prefix, tree);
-        SCFree(node);
-    }
-
-    return;
-}
-
-/**
  * \brief Creates a new Radix tree
  *
  * \param Free Function pointer supplied by the user to be used by the Radix
@@ -1251,74 +1217,6 @@ void SCRadixRemoveKeyIPV6(uint8_t *key_stream, SCRadixTree *tree)
 }
 
 /**
- * \brief Checks if an IP prefix falls under a netblock, in the path to the root
- *        of the tree, from the node.  Used internally by SCRadixFindKey()
- *
- * \param prefix Pointer to the prefix that contains the ip address
- * \param node   Pointer to the node from where we have to climb the tree
- */
-static inline SCRadixNode *SCRadixFindKeyIPNetblock(SCRadixPrefix *prefix,
-                                                    SCRadixNode *node)
-{
-    SCRadixNode *netmask_node = NULL;
-    int mask = 0;
-    int bytes = 0;
-    int i = 0;
-    int j = 0;
-
-    while (node != NULL && node->netmasks == NULL)
-        node = node->parent;
-
-    if (node == NULL)
-        return NULL;
-
-    /* hold the node found containing a netmask.  We will need it when we call
-     * this function recursively */
-    netmask_node = node;
-
-    for (j = 0; j < netmask_node->netmask_cnt; j++) {
-        bytes = prefix->bitlen / 8;
-        for (i = 0; i < bytes; i++) {
-            mask = -1;
-            if ( ((i + 1) * 8) > netmask_node->netmasks[j]) {
-                if ( ((i + 1) * 8 - netmask_node->netmasks[j]) < 8)
-                    mask = -1 << ((i + 1) * 8 - netmask_node->netmasks[j]);
-                else
-                    mask = 0;
-            }
-            prefix->stream[i] &= mask;
-        }
-
-        while (node->bit < prefix->bitlen) {
-            if (SC_RADIX_BITTEST(prefix->stream[node->bit >> 3],
-                                 (0x80 >> (node->bit % 8))) ) {
-                node = node->right;
-            } else {
-                node = node->left;
-            }
-
-            if (node == NULL)
-                return NULL;
-        }
-
-        if (node->bit != prefix->bitlen || node->prefix == NULL)
-            return NULL;
-
-        if (memcmp(node->prefix->stream, prefix->stream, bytes) == 0) {
-            mask = -1 << (8 - prefix->bitlen % 8);
-
-            if (prefix->bitlen % 8 == 0 ||
-                (node->prefix->stream[bytes] & mask) == (prefix->stream[bytes] & mask)) {
-                if (SCRadixPrefixContainNetmaskAndSetUserData(node->prefix, prefix->bitlen, 0))
-                    return node;
-            }
-        }
-    }
-
-    return SCRadixFindKeyIPNetblock(prefix, netmask_node->parent);
-}
-
-/**
  * \brief Checks if an IP address key is present in the tree.  The function
  *        apart from handling any normal data, also handles ipv4/ipv6 netblocks
  *
diff --git a/src/util-radix-tree.h b/src/util-radix-tree.h
index f791760..6cfed45 100644
--- a/src/util-radix-tree.h
+++ b/src/util-radix-tree.h
@@ -108,5 +108,116 @@ void SCRadixPrintTree(SCRadixTree *);
 
 void SCRadixRegisterTests(void);
 
+void SCRadixReleasePrefix(SCRadixPrefix *, SCRadixTree *);
+int SCRadixPrefixContainNetmaskAndSetUserData(SCRadixPrefix *, uint16_t, int);
+/** ----- Inline funcions ------ */
+
+static inline SCRadixNode *SCRadixCreateNode();
+static inline void SCRadixReleaseNode(SCRadixNode *, SCRadixTree *);
+static inline SCRadixNode *SCRadixFindKeyIPNetblock(SCRadixPrefix *, SCRadixNode *);
+
+/**
+ * \brief Creates a new node for the Radix tree
+ *
+ * \retval node The newly created node for the radix tree
+ */
+static inline SCRadixNode *SCRadixCreateNode()
+{
+    SCRadixNode *node = NULL;
+
+    if ( (node = SCMalloc(sizeof(SCRadixNode))) == NULL) {
+        SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory");
+        exit(EXIT_FAILURE);
+    }
+    memset(node, 0, sizeof(SCRadixNode));
+
+    return node;
+}
+
+/**
+ * \brief Frees a Radix tree node
+ *
+ * \param node Pointer to a Radix tree node
+ * \param tree Pointer to the Radix tree to which this node belongs
+ */
+static inline void SCRadixReleaseNode(SCRadixNode *node, SCRadixTree *tree)
+{
+    if (node != NULL) {
+        SCRadixReleasePrefix(node->prefix, tree);
+        SCFree(node);
+    }
+
+    return;
+}
+
+/**
+ * \brief Checks if an IP prefix falls under a netblock, in the path to the root
+ *        of the tree, from the node.  Used internally by SCRadixFindKey()
+ *
+ * \param prefix Pointer to the prefix that contains the ip address
+ * \param node   Pointer to the node from where we have to climb the tree
+ */
+static inline SCRadixNode *SCRadixFindKeyIPNetblock(SCRadixPrefix *prefix,
+                                                    SCRadixNode *node)
+{
+    SCRadixNode *netmask_node = NULL;
+    int mask = 0;
+    int bytes = 0;
+    int i = 0;
+    int j = 0;
+
+    while (node != NULL && node->netmasks == NULL)
+        node = node->parent;
+
+    if (node == NULL)
+        return NULL;
+
+    /* hold the node found containing a netmask.  We will need it when we call
+     * this function recursively */
+    netmask_node = node;
+
+    for (j = 0; j < netmask_node->netmask_cnt; j++) {
+        bytes = prefix->bitlen / 8;
+        for (i = 0; i < bytes; i++) {
+            mask = -1;
+            if ( ((i + 1) * 8) > netmask_node->netmasks[j]) {
+                if ( ((i + 1) * 8 - netmask_node->netmasks[j]) < 8)
+                    mask = -1 << ((i + 1) * 8 - netmask_node->netmasks[j]);
+                else
+                    mask = 0;
+            }
+            prefix->stream[i] &= mask;
+        }
+
+        while (node->bit < prefix->bitlen) {
+            if (SC_RADIX_BITTEST(prefix->stream[node->bit >> 3],
+                                 (0x80 >> (node->bit % 8))) ) {
+                node = node->right;
+            } else {
+                node = node->left;
+            }
+
+            if (node == NULL)
+                return NULL;
+        }
+
+        if (node->bit != prefix->bitlen || node->prefix == NULL)
+            return NULL;
+
+        if (memcmp(node->prefix->stream, prefix->stream, bytes) == 0) {
+            mask = -1 << (8 - prefix->bitlen % 8);
+
+            if (prefix->bitlen % 8 == 0 ||
+                (node->prefix->stream[bytes] & mask) == (prefix->stream[bytes] & mask)) {
+                if (SCRadixPrefixContainNetmaskAndSetUserData(node->prefix, prefix->bitlen, 0))
+                    return node;
+            }
+        }
+    }
+
+    return SCRadixFindKeyIPNetblock(prefix, netmask_node->parent);
+}
+
+
 
 #endif /* __UTIL_RADIX_TREE_H__ */
diff --git a/src/util-spm-bm.c b/src/util-spm-bm.c
index 70e1af0..f345b9b 100644
--- a/src/util-spm-bm.c
+++ b/src/util-spm-bm.c
@@ -18,238 +18,4 @@
 #include <limits.h>
 #include <string.h>
 
-/**
- * \brief Array setup function for bad characters that split the pattern
- *        Remember that the result array should be the length of ALPHABET_SIZE
- *
- * \param str pointer to the pattern string
- * \param size length of the string
- * \param result pointer to an empty array that will hold the badchars
- */
-inline void PreBmBc(const uint8_t *x, int32_t m, int32_t *bmBc) {
-    int32_t i;
-
-    for (i = 0; i < 256; ++i) {
-        bmBc[i] = m;
-    }
-    for (i = 0; i < m - 1; ++i) {
-        bmBc[(unsigned char)x[i]] = m - i - 1;
-    }
-}
-
-/**
- * \brief Array setup function for building prefixes (shift for valid prefixes) for boyermoore context
- *
- * \param x pointer to the pattern string
- * \param m length of the string
- * \param suff pointer to an empty array that will hold the prefixes (shifts)
- */
-inline void BoyerMooreSuffixes(const uint8_t *x, int32_t m, int32_t *suff) {
-    int32_t f = 0, g, i;
-    suff[m - 1] = m;
-    g = m - 1;
-    for (i = m - 2; i >= 0; --i) {
-        if (i > g && suff[i + m - 1 - f] < i - g)
-            suff[i] = suff[i + m - 1 - f];
-        else {
-            if (i < g)
-                g = i;
-            f = i;
-            while (g >= 0 && x[g] == x[g + m - 1 - f])
-                --g;
-            suff[i] = f - g;
-        }
-    }
-}
-
-/**
- * \brief Array setup function for building prefixes (shift for valid prefixes) for boyermoore context
- *
- * \param x pointer to the pattern string
- * \param m length of the string
- * \param bmGs pointer to an empty array that will hold the prefixes (shifts)
- */
-inline void PreBmGs(const uint8_t *x, int32_t m, int32_t *bmGs) {
-    int32_t i, j;
-    int32_t *suff;
-
-    suff = SCMalloc(sizeof(int32_t) * (m + 1));
-
-    BoyerMooreSuffixes(x, m, suff);
-
-    for (i = 0; i < m; ++i)
-        bmGs[i] = m;
-
-    j = 0;
-
-    for (i = m - 1; i >= -1; --i)
-        if (i == -1 || suff[i] == i + 1)
-            for (; j < m - 1 - i; ++j)
-                if (bmGs[j] == m)
-                    bmGs[j] = m - 1 - i;
-
-    for (i = 0; i <= m - 2; ++i)
-        bmGs[m - 1 - suff[i]] = m - 1 - i;
-    SCFree(suff);
-}
-
-/**
- * \brief Array setup function for bad characters that split the pattern
- *        Remember that the result array should be the length of ALPHABET_SIZE
- *
- * \param str pointer to the pattern string
- * \param size length of the string
- * \param result pointer to an empty array that will hold the badchars
- */
-inline void PreBmBcNocase(const uint8_t *x, int32_t m, int32_t *bmBc) {
-    int32_t i;
-
-    for (i = 0; i < 256; ++i) {
-        bmBc[i] = m;
-    }
-    for (i = 0; i < m - 1; ++i) {
-        bmBc[u8_tolower((unsigned char)x[i])] = m - 1 - i;
-    }
-}
-
-inline void BoyerMooreSuffixesNocase(const uint8_t *x, int32_t m, int32_t *suff) {
-    int32_t f = 0, g, i;
-
-    suff[m - 1] = m;
-    g = m - 1;
-    for (i = m - 2; i >= 0; --i) {
-        if (i > g && suff[i + m - 1 - f] < i - g) {
-            suff[i] = suff[i + m - 1 - f];
-        } else {
-            if (i < g) {
-                g = i;
-            }
-            f = i;
-            while (g >= 0 && u8_tolower(x[g]) == u8_tolower(x[g + m - 1 - f])) {
-                --g;
-            }
-            suff[i] = f - g;
-        }
-    }
-}
-
-/**
- * \brief Array setup function for building prefixes (shift for valid prefixes)
- *        for boyermoore context case less
- *
- * \param x pointer to the pattern string
- * \param m length of the string
- * \param bmGs pointer to an empty array that will hold the prefixes (shifts)
- */
-inline void PreBmGsNocase(const uint8_t *x, int32_t m, int32_t *bmGs) {
-    int32_t i, j;
-    int32_t* suff;
-
-    suff = SCMalloc(sizeof(int32_t) * (m + 1));
-
-    BoyerMooreSuffixesNocase(x, m, suff);
-
-    for (i = 0; i < m; ++i) {
-        bmGs[i] = m;
-    }
-    j = 0;
-    for (i = m - 1; i >= 0; --i) {
-        if (i == -1 || suff[i] == i + 1) {
-            for (; j < m - 1 - i; ++j) {
-                if (bmGs[j] == m) {
-                    bmGs[j] = m - 1 - i;
-                }
-            }
-        }
-    }
-    for (i = 0; i <= m - 2; ++i) {
-        bmGs[m - 1 - suff[i]] = m - 1 - i;
-    }
-
-    SCFree(suff);
-}
-
-/**
- * \brief Boyer Moore search algorithm
- *        Is better as the pattern length increases and for big buffers to search in.
- *        The algorithm needs a context of two arrays already prepared
- *        by prep_bad_chars() and prep_good_suffix()
- *
- * \param y pointer to the buffer to search in
- * \param n length limit of the buffer
- * \param x pointer to the pattern we ar searching for
- * \param m length limit of the needle
- * \param bmBc pointer to an array of BoyerMooreSuffixes prepared by prep_good_suffix()
- * \param bmGs pointer to an array of bachars prepared by prep_bad_chars()
- *
- * \retval ptr to start of the match; NULL if no match
- */
-inline uint8_t *BoyerMoore(uint8_t *x, int32_t m, uint8_t *y, int32_t n, int32_t *bmGs, int32_t *bmBc) {
-   int i, j, m1, m2;
-#if 0
-    printf("\nBad:\n");
-    for (i=0;i<ALPHABET_SIZE;i++)
-        printf("%c,%d ", i, bmBc[i]);
-
-    printf("\ngood:\n");
-    for (i=0;i<m;i++)
-        printf("%c, %d ", x[i],bmBc[i]);
-    printf("\n");
-#endif
-   j = 0;
-   while (j <= n - m ) {
-      for (i = m - 1; i >= 0 && x[i] == y[i + j]; --i);
-
-      if (i < 0) {
-         return y + j;
-         j += bmGs[0];
-      } else {
- //        printf("%c", y[i+j]);
-         j += (m1 = bmGs[i]) > (m2 = bmBc[y[i + j]] - m + 1 + i)? m1: m2;
-//            printf("%d, %d\n", m1, m2);
-      }
-   }
-   return NULL;
-}
-
-
-/**
- * \brief Boyer Moore search algorithm
- *        Is better as the pattern length increases and for big buffers to search in.
- *        The algorithm needs a context of two arrays already prepared
- *        by prep_bad_chars() and prep_good_suffix()
- *
- * \param y pointer to the buffer to search in
- * \param n length limit of the buffer
- * \param x pointer to the pattern we ar searching for
- * \param m length limit of the needle
- * \param bmBc pointer to an array of BoyerMooreSuffixes prepared by prep_good_suffix()
- * \param bmGs pointer to an array of bachars prepared by prep_bad_chars()
- *
- * \retval ptr to start of the match; NULL if no match
- */
-inline uint8_t *BoyerMooreNocase(uint8_t *x, int32_t m, uint8_t *y, int32_t n, int32_t *bmGs, int32_t *bmBc) {
-    int i, j, m1, m2;
-#if 0
-    printf("\nBad:\n");
-    for (i=0;i<ALPHABET_SIZE;i++)
-        printf("%c,%d ", i, bmBc[i]);
-
-    printf("\ngood:\n");
-    for (i=0;i<m;i++)
-        printf("%c, %d ", x[i],bmBc[i]);
-    printf("\n");
-#endif
-    j = 0;
-    while (j <= n - m ) {
-        for (i = m - 1; i >= 0 && u8_tolower(x[i]) == u8_tolower(y[i + j]); --i);
-
-        if (i < 0) {
-            return y + j;
-        } else {
-            j += (m1=bmGs[i]) > (m2=bmBc[u8_tolower(y[i + j])] - m + 1 + i)?m1:m2;
-        }
-   }
-   return NULL;
-}
 
diff --git a/src/util-spm-bm.h b/src/util-spm-bm.h
index 8496407..6864a53 100644
--- a/src/util-spm-bm.h
+++ b/src/util-spm-bm.h
@@ -6,14 +6,252 @@
 
 #define ALPHABET_SIZE 256
 
-inline void PreBmBc(const uint8_t *x, int32_t m, int32_t *bmBc);
-inline void BoyerMooreSuffixes(const uint8_t *x, int32_t m, int32_t *suff);
-inline void PreBmGs(const uint8_t *x, int32_t m, int32_t *bmGs);
-inline uint8_t *BoyerMoore(uint8_t *x, int32_t m, uint8_t *y, int32_t n, int32_t *bmGs, int32_t *bmBc);
-inline void PreBmBcNocase(const uint8_t *x, int32_t m, int32_t *bmBc);
-inline void BoyerMooreSuffixesNocase(const uint8_t *x, int32_t m, int32_t *suff);
-inline void PreBmGsNocase(const uint8_t *x, int32_t m, int32_t *bmGs);
-inline uint8_t *BoyerMooreNocase(uint8_t *x, int32_t m, uint8_t *y, int32_t n, int32_t *bmGs, int32_t *bmBc);
+static inline void PreBmBc(const uint8_t *x, int32_t m, int32_t *bmBc);
+static inline void BoyerMooreSuffixes(const uint8_t *x, int32_t m, int32_t *suff);
+static inline void PreBmGs(const uint8_t *x, int32_t m, int32_t *bmGs);
+static inline uint8_t *BoyerMoore(uint8_t *x, int32_t m, uint8_t *y, int32_t n, int32_t *bmGs, int32_t *bmBc);
+static inline void PreBmBcNocase(const uint8_t *x, int32_t m, int32_t *bmBc);
+static inline void BoyerMooreSuffixesNocase(const uint8_t *x, int32_t m, int32_t *suff);
+static inline void PreBmGsNocase(const uint8_t *x, int32_t m, int32_t *bmGs);
+static inline uint8_t *BoyerMooreNocase(uint8_t *x, int32_t m, uint8_t *y, int32_t n, int32_t *bmGs, int32_t *bmBc);
+
+/** --------- Inline functions -------- */
+
+
+/**
+ * \brief Array setup function for bad characters that split the pattern
+ *        Remember that the result array should be the length of ALPHABET_SIZE
+ *
+ * \param str pointer to the pattern string
+ * \param size length of the string
+ * \param result pointer to an empty array that will hold the badchars
+ */
+inline void PreBmBc(const uint8_t *x, int32_t m, int32_t *bmBc) {
+    int32_t i;
+
+    for (i = 0; i < 256; ++i) {
+        bmBc[i] = m;
+    }
+    for (i = 0; i < m - 1; ++i) {
+        bmBc[(unsigned char)x[i]] = m - i - 1;
+    }
+}
+
+/**
+ * \brief Array setup function for building prefixes (shift for valid prefixes) for boyermoore context
+ *
+ * \param x pointer to the pattern string
+ * \param m length of the string
+ * \param suff pointer to an empty array that will hold the prefixes (shifts)
+ */
+inline void BoyerMooreSuffixes(const uint8_t *x, int32_t m, int32_t *suff) {
+    int32_t f = 0, g, i;
+    suff[m - 1] = m;
+    g = m - 1;
+    for (i = m - 2; i >= 0; --i) {
+        if (i > g && suff[i + m - 1 - f] < i - g)
+            suff[i] = suff[i + m - 1 - f];
+        else {
+            if (i < g)
+                g = i;
+            f = i;
+            while (g >= 0 && x[g] == x[g + m - 1 - f])
+                --g;
+            suff[i] = f - g;
+        }
+    }
+}
+
+/**
+ * \brief Array setup function for building prefixes (shift for valid prefixes) for boyermoore context
+ *
+ * \param x pointer to the pattern string
+ * \param m length of the string
+ * \param bmGs pointer to an empty array that will hold the prefixes (shifts)
+ */
+inline void PreBmGs(const uint8_t *x, int32_t m, int32_t *bmGs) {
+    int32_t i, j;
+    int32_t *suff;
+
+    suff = SCMalloc(sizeof(int32_t) * (m + 1));
+
+    BoyerMooreSuffixes(x, m, suff);
+
+    for (i = 0; i < m; ++i)
+        bmGs[i] = m;
+
+    j = 0;
+
+    for (i = m - 1; i >= -1; --i)
+        if (i == -1 || suff[i] == i + 1)
+            for (; j < m - 1 - i; ++j)
+                if (bmGs[j] == m)
+                    bmGs[j] = m - 1 - i;
+
+    for (i = 0; i <= m - 2; ++i)
+        bmGs[m - 1 - suff[i]] = m - 1 - i;
+    SCFree(suff);
+}
+
+/**
+ * \brief Array setup function for bad characters that split the pattern
+ *        Remember that the result array should be the length of ALPHABET_SIZE
+ *
+ * \param str pointer to the pattern string
+ * \param size length of the string
+ * \param result pointer to an empty array that will hold the badchars
+ */
+inline void PreBmBcNocase(const uint8_t *x, int32_t m, int32_t *bmBc) {
+    int32_t i;
+
+    for (i = 0; i < 256; ++i) {
+        bmBc[i] = m;
+    }
+    for (i = 0; i < m - 1; ++i) {
+        bmBc[u8_tolower((unsigned char)x[i])] = m - 1 - i;
+    }
+}
+
+inline void BoyerMooreSuffixesNocase(const uint8_t *x, int32_t m, int32_t *suff) {
+    int32_t f = 0, g, i;
+
+    suff[m - 1] = m;
+    g = m - 1;
+    for (i = m - 2; i >= 0; --i) {
+        if (i > g && suff[i + m - 1 - f] < i - g) {
+            suff[i] = suff[i + m - 1 - f];
+        } else {
+            if (i < g) {
+                g = i;
+            }
+            f = i;
+            while (g >= 0 && u8_tolower(x[g]) == u8_tolower(x[g + m - 1 - f])) {
+                --g;
+            }
+            suff[i] = f - g;
+        }
+    }
+}
+
+/**
+ * \brief Array setup function for building prefixes (shift for valid prefixes)
+ *        for boyermoore context case less
+ *
+ * \param x pointer to the pattern string
+ * \param m length of the string
+ * \param bmGs pointer to an empty array that will hold the prefixes (shifts)
+ */
+inline void PreBmGsNocase(const uint8_t *x, int32_t m, int32_t *bmGs) {
+    int32_t i, j;
+    int32_t* suff;
+
+    suff = SCMalloc(sizeof(int32_t) * (m + 1));
+
+    BoyerMooreSuffixesNocase(x, m, suff);
+
+    for (i = 0; i < m; ++i) {
+        bmGs[i] = m;
+    }
+    j = 0;
+    for (i = m - 1; i >= 0; --i) {
+        if (i == -1 || suff[i] == i + 1) {
+            for (; j < m - 1 - i; ++j) {
+                if (bmGs[j] == m) {
+                    bmGs[j] = m - 1 - i;
+                }
+            }
+        }
+    }
+    for (i = 0; i <= m - 2; ++i) {
+        bmGs[m - 1 - suff[i]] = m - 1 - i;
+    }
+
+    SCFree(suff);
+}
+
+/**
+ * \brief Boyer Moore search algorithm
+ *        Is better as the pattern length increases and for big buffers to search in.
+ *        The algorithm needs a context of two arrays already prepared
+ *        by prep_bad_chars() and prep_good_suffix()
+ *
+ * \param y pointer to the buffer to search in
+ * \param n length limit of the buffer
+ * \param x pointer to the pattern we ar searching for
+ * \param m length limit of the needle
+ * \param bmBc pointer to an array of BoyerMooreSuffixes prepared by prep_good_suffix()
+ * \param bmGs pointer to an array of bachars prepared by prep_bad_chars()
+ *
+ * \retval ptr to start of the match; NULL if no match
+ */
+inline uint8_t *BoyerMoore(uint8_t *x, int32_t m, uint8_t *y, int32_t n, int32_t *bmGs, int32_t *bmBc) {
+   int i, j, m1, m2;
+#if 0
+    printf("\nBad:\n");
+    for (i=0;i<ALPHABET_SIZE;i++)
+        printf("%c,%d ", i, bmBc[i]);
+
+    printf("\ngood:\n");
+    for (i=0;i<m;i++)
+        printf("%c, %d ", x[i],bmBc[i]);
+    printf("\n");
+#endif
+   j = 0;
+   while (j <= n - m ) {
+      for (i = m - 1; i >= 0 && x[i] == y[i + j]; --i);
+
+      if (i < 0) {
+         return y + j;
+         j += bmGs[0];
+      } else {
+ //        printf("%c", y[i+j]);
+         j += (m1 = bmGs[i]) > (m2 = bmBc[y[i + j]] - m + 1 + i)? m1: m2;
+//            printf("%d, %d\n", m1, m2);
+      }
+   }
+   return NULL;
+}
+
+
+/**
+ * \brief Boyer Moore search algorithm
+ *        Is better as the pattern length increases and for big buffers to search in.
+ *        The algorithm needs a context of two arrays already prepared
+ *        by prep_bad_chars() and prep_good_suffix()
+ *
+ * \param y pointer to the buffer to search in
+ * \param n length limit of the buffer
+ * \param x pointer to the pattern we ar searching for
+ * \param m length limit of the needle
+ * \param bmBc pointer to an array of BoyerMooreSuffixes prepared by prep_good_suffix()
+ * \param bmGs pointer to an array of bachars prepared by prep_bad_chars()
+ *
+ * \retval ptr to start of the match; NULL if no match
+ */
+inline uint8_t *BoyerMooreNocase(uint8_t *x, int32_t m, uint8_t *y, int32_t n, int32_t *bmGs, int32_t *bmBc) {
+    int i, j, m1, m2;
+#if 0
+    printf("\nBad:\n");
+    for (i=0;i<ALPHABET_SIZE;i++)
+        printf("%c,%d ", i, bmBc[i]);
+
+    printf("\ngood:\n");
+    for (i=0;i<m;i++)
+        printf("%c, %d ", x[i],bmBc[i]);
+    printf("\n");
+#endif
+    j = 0;
+    while (j <= n - m ) {
+        for (i = m - 1; i >= 0 && u8_tolower(x[i]) == u8_tolower(y[i + j]); --i);
+
+        if (i < 0) {
+            return y + j;
+        } else {
+            j += (m1=bmGs[i]) > (m2=bmBc[u8_tolower(y[i + j])] - m + 1 + i)?m1:m2;
+        }
+   }
+   return NULL;
+}
 
 #endif /* __UTIL_SPM_BM__ */
 
diff --git a/src/util-spm-bs.c b/src/util-spm-bs.c
index e775aaa..e0f1e3c 100644
--- a/src/util-spm-bs.c
+++ b/src/util-spm-bs.c
@@ -17,92 +17,4 @@
 #include <limits.h>
 #include <string.h>
 
-/**
- * \brief Basic search improved. Limits are better handled, so
- * it doesn't start searches that wont fit in the remaining buffer
- *
- * \param haystack pointer to the buffer to search in
- * \param haystack_len length limit of the buffer
- * \param neddle pointer to the pattern we ar searching for
- * \param needle_len length limit of the needle
- *
- * \retval ptr to start of the match; NULL if no match
- */
-inline uint8_t *BasicSearch(const uint8_t *haystack, uint32_t haystack_len, const uint8_t *needle, uint32_t needle_len) {
-    const uint8_t *h, *n;
-    const uint8_t *hmax = haystack + haystack_len;
-    const uint8_t *nmax = needle + needle_len;
-
-    if (needle_len == 0 || needle_len > haystack_len)
-        return NULL;
-
-    for (n = needle; nmax - n <= hmax - haystack; haystack++) {
-        if (*haystack != *n) {
-            continue;
-        }
-        /* one byte needles */
-        if (needle_len == 1)
-            return (uint8_t *)haystack;
-
-        for (h = haystack+1, n++; nmax - n <= hmax - haystack; h++, n++) {
-            if (*h != *n) {
-                break;
-            }
-            /* if we run out of needle we fully matched */
-            if (n == nmax - 1) {
-                return (uint8_t *)haystack;
-            }
-        }
-        n = needle;
-    }
-
-    return NULL;
-}
-
-/**
- * \brief Basic search case less
- *
- * \param haystack pointer to the buffer to search in
- * \param haystack_len length limit of the buffer
- * \param neddle pointer to the pattern we ar searching for
- * \param needle_len length limit of the needle
- *
- * \retval ptr to start of the match; NULL if no match
- */
-inline uint8_t *BasicSearchNocase(const uint8_t *haystack, uint32_t haystack_len, const uint8_t *needle, uint32_t needle_len) {
-    const uint8_t *h, *n;
-    const uint8_t *hmax = haystack + haystack_len;
-    const uint8_t *nmax = needle + needle_len;
-
-    if (needle_len == 0 || needle_len > haystack_len)
-        return NULL;
-
-    n = needle;
-    for (n = needle; nmax - n <= hmax - haystack; haystack++) {
-        if (u8_tolower(*haystack) != u8_tolower(*n)) {
-            continue;
-        }
-        /* one byte needles */
-        if (needle_len == 1) {
-            return (uint8_t *)haystack;
-        }
-
-        for (h = haystack+1, n++; nmax - n <= hmax - h ; h++, n++) {
-            if (u8_tolower(*h) != u8_tolower(*n)) {
-                break;
-            }
-            /* if we run out of needle we fully matched */
-            if (n == nmax - 1) {
-                return (uint8_t *)haystack;
-            }
-        }
-        n = needle;
-    }
-
-    return NULL;
-}
-
-inline void BasicSearchInit (void) {
-    /* nothing no more */
-}
-
+/* Look at the .h, all the functions are Inlined */
diff --git a/src/util-spm-bs.h b/src/util-spm-bs.h
index 6bb3afb..614f60f 100644
--- a/src/util-spm-bs.h
+++ b/src/util-spm-bs.h
@@ -3,10 +3,100 @@
 
 #include "suricata-common.h"
 #include "suricata.h"
+/** ----- Inline functions ------- */
+static inline uint8_t *BasicSearch(const uint8_t *, uint32_t, const uint8_t *, uint32_t);
+static inline uint8_t *BasicSearchNocase(const uint8_t *, uint32_t, const uint8_t *, uint32_t);
+static inline void BasicSearchInit (void);
+
+/**
+ * \brief Basic search improved. Limits are better handled, so
+ * it doesn't start searches that wont fit in the remaining buffer
+ *
+ * \param haystack pointer to the buffer to search in
+ * \param haystack_len length limit of the buffer
+ * \param neddle pointer to the pattern we ar searching for
+ * \param needle_len length limit of the needle
+ *
+ * \retval ptr to start of the match; NULL if no match
+ */
+static inline uint8_t *BasicSearch(const uint8_t *haystack, uint32_t haystack_len, const uint8_t *needle, uint32_t needle_len) {
+    const uint8_t *h, *n;
+    const uint8_t *hmax = haystack + haystack_len;
+    const uint8_t *nmax = needle + needle_len;
+
+    if (needle_len == 0 || needle_len > haystack_len)
+        return NULL;
+
+    for (n = needle; nmax - n <= hmax - haystack; haystack++) {
+        if (*haystack != *n) {
+            continue;
+        }
+        /* one byte needles */
+        if (needle_len == 1)
+            return (uint8_t *)haystack;
+
+        for (h = haystack+1, n++; nmax - n <= hmax - haystack; h++, n++) {
+            if (*h != *n) {
+                break;
+            }
+            /* if we run out of needle we fully matched */
+            if (n == nmax - 1) {
+                return (uint8_t *)haystack;
+            }
+        }
+        n = needle;
+    }
+
+    return NULL;
+}
+
+/**
+ * \brief Basic search case less
+ *
+ * \param haystack pointer to the buffer to search in
+ * \param haystack_len length limit of the buffer
+ * \param neddle pointer to the pattern we ar searching for
+ * \param needle_len length limit of the needle
+ *
+ * \retval ptr to start of the match; NULL if no match
+ */
+static inline uint8_t *BasicSearchNocase(const uint8_t *haystack, uint32_t haystack_len, const uint8_t *needle, uint32_t needle_len) {
+    const uint8_t *h, *n;
+    const uint8_t *hmax = haystack + haystack_len;
+    const uint8_t *nmax = needle + needle_len;
+
+    if (needle_len == 0 || needle_len > haystack_len)
+        return NULL;
+
+    n = needle;
+    for (n = needle; nmax - n <= hmax - haystack; haystack++) {
+        if (u8_tolower(*haystack) != u8_tolower(*n)) {
+            continue;
+        }
+        /* one byte needles */
+        if (needle_len == 1) {
+            return (uint8_t *)haystack;
+        }
+
+        for (h = haystack+1, n++; nmax - n <= hmax - h ; h++, n++) {
+            if (u8_tolower(*h) != u8_tolower(*n)) {
+                break;
+            }
+            /* if we run out of needle we fully matched */
+            if (n == nmax - 1) {
+                return (uint8_t *)haystack;
+            }
+        }
+        n = needle;
+    }
+
+    return NULL;
+}
+
+static inline void BasicSearchInit (void) {
+    /* nothing no more */
+}
 
-inline uint8_t *BasicSearch(const uint8_t *, uint32_t, const uint8_t *, uint32_t);
-inline uint8_t *BasicSearchNocase(const uint8_t *, uint32_t, const uint8_t *, uint32_t);
-inline void BasicSearchInit (void);
 
 #endif /* __UTIL_SPM_BS__ */
 
diff --git a/src/util-spm-bs2bm.c b/src/util-spm-bs2bm.c
index 552e843..3537a4a 100644
--- a/src/util-spm-bs2bm.c
+++ b/src/util-spm-bs2bm.c
@@ -16,144 +16,4 @@
 #include <limits.h>
 #include <string.h>
 
-/**
- * \brief Array setup function for Bs2Bm of bad characters index (not found at the needle)
- *
- * \param neddle pointer to the pattern we ar searching for
- * \param needle_len length limit of the needle
- * \param badchars pointer to an empty array of bachars. The array prepared contains
- *                 characters that can't be inside the needle_len. So the skips can be
- *                 faster
- */
-inline void Bs2BmBadchars(const uint8_t *needle, uint32_t needle_len, uint8_t *badchars) {
-    uint32_t i;
-    for (i = 0; i < ALPHABET_SIZE; i++)
-        badchars[i] = 1;
-
-    /* set to 0 the values where index as ascii is present
-     * because they are not badchars
-     */
-    for (i = 0; i < needle_len; i++)
-        badchars[needle[i]] = 0;
-}
-
-/**
- * \brief Array setup function for Bs2BmNocase of bad characters index (not found at the needle)
- *
- * \param neddle pointer to the pattern we ar searching for
- * \param needle_len length limit of the needle
- * \param badchars pointer to an empty array of bachars. The array prepared contains
- *                 characters that can't be inside the needle_len. So the skips can be
- *                 faster
- */
-inline void Bs2BmBadcharsNocase(const uint8_t *needle, uint32_t needle_len, uint8_t *badchars) {
-    uint32_t i;
-    for (i = 0; i < ALPHABET_SIZE; i++)
-        badchars[i] = 1;
-
-    /* set to 0 the values where index as ascii is present
-     * because they are not badchars
-     */
-    for (i = 0; i < needle_len; i++) {
-        badchars[u8_tolower(needle[i])] = 0;
-    }
-}
-
-
-/**
- * \brief Basic search with a bad characters array. The array badchars contains
- *        flags at character's ascii index that can't be inside the needle. So the skips can be
- *        faster
- *
- * \param haystack pointer to the buffer to search in
- * \param haystack_len length limit of the buffer
- * \param neddle pointer to the pattern we ar searching for
- * \param needle_len length limit of the needle
- * \param badchars pointer to an array of bachars prepared by Bs2BmBadchars()
- *
- * \retval ptr to start of the match; NULL if no match
- */
-inline uint8_t * Bs2Bm(const uint8_t *haystack, uint32_t haystack_len, const uint8_t *needle, uint32_t needle_len, uint8_t badchars[])
-{
-    const uint8_t *h, *n;
-    const uint8_t *hmax = haystack + haystack_len;
-    const uint8_t *nmax = needle + needle_len;
-
-    if (needle_len == 0 || needle_len > haystack_len)
-        return NULL;
-
-    for (n = needle; nmax - n <= hmax - haystack; haystack++) {
-        if (*haystack != *n) {
-            continue;
-        }
-        /* one byte needles */
-        if (needle_len == 1)
-            return (uint8_t *)haystack;
-
-        for (h = haystack+1, n++; nmax - n <= hmax - haystack; h++, n++) {
-            if (*h != *n) {
-                if (badchars[*h] == 1) {
-                    /* skip it! */
-                    haystack = h;
-                }
-                break;
-            }
-            /* if we run out of needle we fully matched */
-            if (n == nmax - 1 ) {
-                return (uint8_t *)haystack;
-            }
-        }
-        n = needle;
-    }
-
-    return NULL;
-}
-
-/**
- * \brief Basic search case less with a bad characters array. The array badchars contains
- *        flags at character's ascii index that can't be inside the needle. So the skips can be
- *        faster
- *
- * \param haystack pointer to the buffer to search in
- * \param haystack_len length limit of the buffer
- * \param neddle pointer to the pattern we ar searching for
- * \param needle_len length limit of the needle
- * \param badchars pointer to an array of bachars prepared by Bs2BmBadchars()
- *
- * \retval ptr to start of the match; NULL if no match
- */
-inline uint8_t *Bs2BmNocase(const uint8_t *haystack, uint32_t haystack_len, const uint8_t *needle, uint32_t needle_len, uint8_t badchars[])
-{
-    const uint8_t *h, *n;
-    const uint8_t *hmax = haystack + haystack_len;
-    const uint8_t *nmax = needle + needle_len;
-
-    if (needle_len == 0 || needle_len > haystack_len)
-        return NULL;
-
-    for (n = needle; nmax - n <= hmax - haystack; haystack++) {
-        if (u8_tolower(*haystack) != u8_tolower(*n)) {
-            continue;
-        }
-        /* one byte needles */
-        if (needle_len == 1)
-            return (uint8_t *)haystack;
-
-        for (h = haystack+1, n++; nmax - n <= hmax - haystack; h++, n++) {
-            if (u8_tolower(*h) != u8_tolower(*n)) {
-                if (badchars[u8_tolower(*h)] == 1) {
-                    /* skip it! */
-                    haystack = h;
-                }
-                break;
-            }
-            /* if we run out of needle we fully matched */
-            if (n == nmax - 1) {
-                return (uint8_t *)haystack;
-            }
-        }
-        n = needle;
-    }
-
-    return NULL;
-}
+/* Look at the .h, all the functions are Inline */
diff --git a/src/util-spm-bs2bm.h b/src/util-spm-bs2bm.h
index 5ec6806..3784cee 100644
--- a/src/util-spm-bs2bm.h
+++ b/src/util-spm-bs2bm.h
@@ -6,10 +6,153 @@
 
 #define ALPHABET_SIZE 256
 
-inline void Bs2BmBadchars(const uint8_t *, uint32_t, uint8_t *);
-inline void Bs2BmBadcharsNocase(const uint8_t *, uint32_t, uint8_t *);
-inline uint8_t * Bs2Bm(const uint8_t *, uint32_t, const uint8_t *, uint32_t, uint8_t []);
-inline uint8_t *Bs2BmNocase(const uint8_t *, uint32_t, const uint8_t *, uint32_t, uint8_t []);
+/** ----- Inline funcions ------ */
 
+static inline void Bs2BmBadchars(const uint8_t *, uint32_t, uint8_t *);
+static inline void Bs2BmBadcharsNocase(const uint8_t *, uint32_t, uint8_t *);
+static inline uint8_t * Bs2Bm(const uint8_t *, uint32_t, const uint8_t *, uint32_t, uint8_t []);
+static inline uint8_t *Bs2BmNocase(const uint8_t *, uint32_t, const uint8_t *, uint32_t, uint8_t []);
+
+/**
+ * \brief Array setup function for Bs2Bm of bad characters index (not found at the needle)
+ *
+ * \param neddle pointer to the pattern we ar searching for
+ * \param needle_len length limit of the needle
+ * \param badchars pointer to an empty array of bachars. The array prepared contains
+ *                 characters that can't be inside the needle_len. So the skips can be
+ *                 faster
+ */
+static inline void Bs2BmBadchars(const uint8_t *needle, uint32_t needle_len, uint8_t *badchars) {
+    uint32_t i;
+    for (i = 0; i < ALPHABET_SIZE; i++)
+        badchars[i] = 1;
+
+    /* set to 0 the values where index as ascii is present
+     * because they are not badchars
+     */
+    for (i = 0; i < needle_len; i++)
+        badchars[needle[i]] = 0;
+}
+
+/**
+ * \brief Array setup function for Bs2BmNocase of bad characters index (not found at the needle)
+ *
+ * \param neddle pointer to the pattern we ar searching for
+ * \param needle_len length limit of the needle
+ * \param badchars pointer to an empty array of bachars. The array prepared contains
+ *                 characters that can't be inside the needle_len. So the skips can be
+ *                 faster
+ */
+static inline void Bs2BmBadcharsNocase(const uint8_t *needle, uint32_t needle_len, uint8_t *badchars) {
+    uint32_t i;
+    for (i = 0; i < ALPHABET_SIZE; i++)
+        badchars[i] = 1;
+
+    /* set to 0 the values where index as ascii is present
+     * because they are not badchars
+     */
+    for (i = 0; i < needle_len; i++) {
+        badchars[u8_tolower(needle[i])] = 0;
+    }
+}
+
+
+/**
+ * \brief Basic search with a bad characters array. The array badchars contains
+ *        flags at character's ascii index that can't be inside the needle. So the skips can be
+ *        faster
+ *
+ * \param haystack pointer to the buffer to search in
+ * \param haystack_len length limit of the buffer
+ * \param neddle pointer to the pattern we ar searching for
+ * \param needle_len length limit of the needle
+ * \param badchars pointer to an array of bachars prepared by Bs2BmBadchars()
+ *
+ * \retval ptr to start of the match; NULL if no match
+ */
+static inline uint8_t * Bs2Bm(const uint8_t *haystack, uint32_t haystack_len, const uint8_t *needle, uint32_t needle_len, uint8_t badchars[])
+{
+    const uint8_t *h, *n;
+    const uint8_t *hmax = haystack + haystack_len;
+    const uint8_t *nmax = needle + needle_len;
+
+    if (needle_len == 0 || needle_len > haystack_len)
+        return NULL;
+
+    for (n = needle; nmax - n <= hmax - haystack; haystack++) {
+        if (*haystack != *n) {
+            continue;
+        }
+        /* one byte needles */
+        if (needle_len == 1)
+            return (uint8_t *)haystack;
+
+        for (h = haystack+1, n++; nmax - n <= hmax - haystack; h++, n++) {
+            if (*h != *n) {
+                if (badchars[*h] == 1) {
+                    /* skip it! */
+                    haystack = h;
+                }
+                break;
+            }
+            /* if we run out of needle we fully matched */
+            if (n == nmax - 1 ) {
+                return (uint8_t *)haystack;
+            }
+        }
+        n = needle;
+    }
+
+    return NULL;
+}
+
+/**
+ * \brief Basic search case less with a bad characters array. The array badchars contains
+ *        flags at character's ascii index that can't be inside the needle. So the skips can be
+ *        faster
+ *
+ * \param haystack pointer to the buffer to search in
+ * \param haystack_len length limit of the buffer
+ * \param neddle pointer to the pattern we ar searching for
+ * \param needle_len length limit of the needle
+ * \param badchars pointer to an array of bachars prepared by Bs2BmBadchars()
+ *
+ * \retval ptr to start of the match; NULL if no match
+ */
+static inline uint8_t *Bs2BmNocase(const uint8_t *haystack, uint32_t haystack_len, const uint8_t *needle, uint32_t needle_len, uint8_t badchars[])
+{
+    const uint8_t *h, *n;
+    const uint8_t *hmax = haystack + haystack_len;
+    const uint8_t *nmax = needle + needle_len;
+
+    if (needle_len == 0 || needle_len > haystack_len)
+        return NULL;
+
+    for (n = needle; nmax - n <= hmax - haystack; haystack++) {
+        if (u8_tolower(*haystack) != u8_tolower(*n)) {
+            continue;
+        }
+        /* one byte needles */
+        if (needle_len == 1)
+            return (uint8_t *)haystack;
+
+        for (h = haystack+1, n++; nmax - n <= hmax - haystack; h++, n++) {
+            if (u8_tolower(*h) != u8_tolower(*n)) {
+                if (badchars[u8_tolower(*h)] == 1) {
+                    /* skip it! */
+                    haystack = h;
+                }
+                break;
+            }
+            /* if we run out of needle we fully matched */
+            if (n == nmax - 1) {
+                return (uint8_t *)haystack;
+            }
+        }
+        n = needle;
+    }
+
+    return NULL;
+}
 #endif /* __UTIL_SPM_BS2BM__ */
 
diff --git a/src/util-spm.c b/src/util-spm.c
index 8e45e31..e9a6bfe 100644
--- a/src/util-spm.c
+++ b/src/util-spm.c
@@ -41,87 +41,7 @@
 #include "util-clock.h"
 
 
-/**
- * Wrappers for building context and searching (Bs2Bm and boyermoore)
- * Use them if you cant store the context
- *
- */
-
-/**
- * \brief Search a pattern in the text using the Bs2Bm algorithm (build a bad characters array)
- *
- * \param text Text to search in
- * \param textlen length of the text
- * \param needle pattern to search for
- * \param needlelen length of the pattern
- */
-inline uint8_t *Bs2bmSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen) {
-    uint8_t badchars[ALPHABET_SIZE];
-    Bs2BmBadchars(needle, needlelen, badchars);
-
-    return Bs2Bm(text, textlen, needle, needlelen, badchars);
-}
-
-/**
- * \brief Search a pattern in the text using the Bs2Bm nocase algorithm (build a bad characters array)
- *
- * \param text Text to search in
- * \param textlen length of the text
- * \param needle pattern to search for
- * \param needlelen length of the pattern
- */
-inline uint8_t *Bs2bmNocaseSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen) {
-    uint8_t badchars[ALPHABET_SIZE];
-    Bs2BmBadchars(needle, needlelen, badchars);
-
-    return Bs2BmNocase(text, textlen, needle, needlelen, badchars);
-}
-
-/**
- * \brief Search a pattern in the text using Boyer Moore algorithm
- *        (build a bad character shifts array and good prefixes shift array)
- *
- * \param text Text to search in
- * \param textlen length of the text
- * \param needle pattern to search for
- * \param needlelen length of the pattern
- */
-inline uint8_t *BoyerMooreSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen) {
-    int32_t bmBc[ALPHABET_SIZE];
-    int32_t *bmGs = SCMalloc(sizeof(int32_t)*(needlelen + 1));
-
-    PreBmGs(needle, needlelen, bmGs);
-    PreBmBc(needle, needlelen, bmBc);
-
-    uint8_t *ret = BoyerMoore(needle, needlelen, text, textlen, bmGs, bmBc);
-    SCFree(bmGs);
-
-    return ret;
-}
-
-/**
- * \brief Search a pattern in the text using Boyer Moore nocase algorithm
- *        (build a bad character shifts array and good prefixes shift array)
- *
- * \param text Text to search in
- * \param textlen length of the text
- * \param needle pattern to search for
- * \param needlelen length of the pattern
- */
-inline uint8_t *BoyerMooreNocaseSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen) {
-    int32_t bmBc[ALPHABET_SIZE];
-    int32_t *bmGs = SCMalloc(sizeof(int32_t)*(needlelen + 1));
-
-    PreBmGsNocase(needle, needlelen, bmGs);
-    PreBmBcNocase(needle, needlelen, bmBc);
-
-    uint8_t *ret = BoyerMooreNocase(needle, needlelen, text, textlen, bmGs, bmBc);
-    SCFree(bmGs);
-
-    return ret;
-}
-
-
+/* Look at the .h, all the functions are Inline */
 #ifdef UNITTESTS
 
 /** Comment out this if you want stats
@@ -138,7 +58,7 @@ inline uint8_t *BoyerMooreNocaseSearch(uint8_t *text, uint32_t textlen, uint8_t
  * \param times If you are testing performance, se the numebr of times
  *              that you want to repeat the search
  */
-inline uint8_t *BasicSearchWrapper(uint8_t *text, uint8_t *needle, int times) {
+uint8_t *BasicSearchWrapper(uint8_t *text, uint8_t *needle, int times) {
     uint32_t textlen = strlen((char *)text);
     uint32_t needlelen = strlen((char *)needle);
 
@@ -157,7 +77,7 @@ inline uint8_t *BasicSearchWrapper(uint8_t *text, uint8_t *needle, int times) {
     return ret;
 }
 
-inline uint8_t *BasicSearchNocaseWrapper(uint8_t *text, uint8_t *needle, int times) {
+uint8_t *BasicSearchNocaseWrapper(uint8_t *text, uint8_t *needle, int times) {
     uint32_t textlen = strlen((char *)text);
     uint32_t needlelen = strlen((char *)needle);
 
@@ -173,7 +93,7 @@ inline uint8_t *BasicSearchNocaseWrapper(uint8_t *text, uint8_t *needle, int tim
     return ret;
 }
 
-inline uint8_t *Bs2bmWrapper(uint8_t *text, uint8_t *needle, int times) {
+uint8_t *Bs2bmWrapper(uint8_t *text, uint8_t *needle, int times) {
     uint32_t textlen = strlen((char *)text);
     uint32_t needlelen = strlen((char *)needle);
 
@@ -192,7 +112,7 @@ inline uint8_t *Bs2bmWrapper(uint8_t *text, uint8_t *needle, int times) {
     return ret;
 }
 
-inline uint8_t *Bs2bmNocaseWrapper(uint8_t *text, uint8_t *needle, int times) {
+uint8_t *Bs2bmNocaseWrapper(uint8_t *text, uint8_t *needle, int times) {
     uint32_t textlen = strlen((char *)text);
     uint32_t needlelen = strlen((char *)needle);
 
@@ -211,7 +131,7 @@ inline uint8_t *Bs2bmNocaseWrapper(uint8_t *text, uint8_t *needle, int times) {
     return ret;
 }
 
-inline uint8_t *BoyerMooreWrapper(uint8_t *text, uint8_t *needle, int times) {
+uint8_t *BoyerMooreWrapper(uint8_t *text, uint8_t *needle, int times) {
     uint32_t textlen = strlen((char *)text);
     uint32_t needlelen = strlen((char *)needle);
 
@@ -234,7 +154,7 @@ inline uint8_t *BoyerMooreWrapper(uint8_t *text, uint8_t *needle, int times) {
     return ret;
 }
 
-inline uint8_t *BoyerMooreNocaseWrapper(uint8_t *text, uint8_t *needle, int times) {
+uint8_t *BoyerMooreNocaseWrapper(uint8_t *text, uint8_t *needle, int times) {
     uint32_t textlen = strlen((char *)text);
     uint32_t needlelen = strlen((char *)needle);
 
@@ -265,7 +185,7 @@ inline uint8_t *BoyerMooreNocaseWrapper(uint8_t *text, uint8_t *needle, int time
  * \param times If you are testing performance, se the numebr of times
  *              that you want to repeat the search
  */
-inline uint8_t *BasicSearchCtxWrapper(uint8_t *text, uint8_t *needle, int times) {
+uint8_t *BasicSearchCtxWrapper(uint8_t *text, uint8_t *needle, int times) {
     uint32_t textlen = strlen((char *)text);
     uint32_t needlelen = strlen((char *)needle);
 
@@ -282,7 +202,7 @@ inline uint8_t *BasicSearchCtxWrapper(uint8_t *text, uint8_t *needle, int times)
     return ret;
 }
 
-inline uint8_t *BasicSearchNocaseCtxWrapper(uint8_t *text, uint8_t *needle, int times) {
+uint8_t *BasicSearchNocaseCtxWrapper(uint8_t *text, uint8_t *needle, int times) {
     uint32_t textlen = strlen((char *)text);
     uint32_t needlelen = strlen((char *)needle);
 
@@ -299,7 +219,7 @@ inline uint8_t *BasicSearchNocaseCtxWrapper(uint8_t *text, uint8_t *needle, int
     return ret;
 }
 
-inline uint8_t *Bs2bmCtxWrapper(uint8_t *text, uint8_t *needle, int times) {
+uint8_t *Bs2bmCtxWrapper(uint8_t *text, uint8_t *needle, int times) {
     uint32_t textlen = strlen((char *)text);
     uint32_t needlelen = strlen((char *)needle);
 
@@ -319,7 +239,7 @@ inline uint8_t *Bs2bmCtxWrapper(uint8_t *text, uint8_t *needle, int times) {
     return ret;
 }
 
-inline uint8_t *Bs2bmNocaseCtxWrapper(uint8_t *text, uint8_t *needle, int times) {
+uint8_t *Bs2bmNocaseCtxWrapper(uint8_t *text, uint8_t *needle, int times) {
     uint32_t textlen = strlen((char *)text);
     uint32_t needlelen = strlen((char *)needle);
 
@@ -339,7 +259,7 @@ inline uint8_t *Bs2bmNocaseCtxWrapper(uint8_t *text, uint8_t *needle, int times)
     return ret;
 }
 
-inline uint8_t *BoyerMooreCtxWrapper(uint8_t *text, uint8_t *needle, int times) {
+uint8_t *BoyerMooreCtxWrapper(uint8_t *text, uint8_t *needle, int times) {
     uint32_t textlen = strlen((char *)text);
     uint32_t needlelen = strlen((char *)needle);
 
@@ -363,7 +283,7 @@ inline uint8_t *BoyerMooreCtxWrapper(uint8_t *text, uint8_t *needle, int times)
     return ret;
 }
 
-inline uint8_t *RawCtxWrapper(uint8_t *text, uint8_t *needle, int times) {
+uint8_t *RawCtxWrapper(uint8_t *text, uint8_t *needle, int times) {
     uint32_t textlen = strlen((char *)text);
     uint32_t needlelen = strlen((char *)needle);
 
@@ -379,7 +299,7 @@ inline uint8_t *RawCtxWrapper(uint8_t *text, uint8_t *needle, int times) {
     return ret;
 }
 
-inline uint8_t *BoyerMooreNocaseCtxWrapper(uint8_t *text, uint8_t *needle, int times) {
+uint8_t *BoyerMooreNocaseCtxWrapper(uint8_t *text, uint8_t *needle, int times) {
     uint32_t textlen = strlen((char *)text);
     uint32_t needlelen = strlen((char *)needle);
 
diff --git a/src/util-spm.h b/src/util-spm.h
index 46e6a36..971cc44 100644
--- a/src/util-spm.h
+++ b/src/util-spm.h
@@ -8,10 +8,10 @@
 #include "util-spm-bm.h"
 
 /** Default algorithm to use: Boyer Moore */
-inline uint8_t *Bs2bmSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen);
-inline uint8_t *Bs2bmNocaseSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen);
-inline uint8_t *BoyerMooreSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen);
-inline uint8_t *BoyerMooreNocaseSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen);
+static inline uint8_t *Bs2bmSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen);
+static inline uint8_t *Bs2bmNocaseSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen);
+static inline uint8_t *BoyerMooreSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen);
+static inline uint8_t *BoyerMooreNocaseSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen);
 
 /* Macros for automatic algorithm selection (use them only when you can't store the context) */
 #define SpmSearch(text, textlen, needle, needlelen) ({\
@@ -37,4 +37,88 @@ inline uint8_t *BoyerMooreNocaseSearch(uint8_t *text, uint32_t textlen, uint8_t
     })
 
 void UtilSpmSearchRegistertests(void);
+
+/** ------ inline functions ------ */
+
+/**
+ * Wrappers for building context and searching (Bs2Bm and boyermoore)
+ * Use them if you cant store the context
+ *
+ */
+
+/**
+ * \brief Search a pattern in the text using the Bs2Bm algorithm (build a bad characters array)
+ *
+ * \param text Text to search in
+ * \param textlen length of the text
+ * \param needle pattern to search for
+ * \param needlelen length of the pattern
+ */
+static inline uint8_t *Bs2bmSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen) {
+    uint8_t badchars[ALPHABET_SIZE];
+    Bs2BmBadchars(needle, needlelen, badchars);
+
+    return Bs2Bm(text, textlen, needle, needlelen, badchars);
+}
+
+/**
+ * \brief Search a pattern in the text using the Bs2Bm nocase algorithm (build a bad characters array)
+ *
+ * \param text Text to search in
+ * \param textlen length of the text
+ * \param needle pattern to search for
+ * \param needlelen length of the pattern
+ */
+static inline uint8_t *Bs2bmNocaseSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen) {
+    uint8_t badchars[ALPHABET_SIZE];
+    Bs2BmBadchars(needle, needlelen, badchars);
+
+    return Bs2BmNocase(text, textlen, needle, needlelen, badchars);
+}
+
+/**
+ * \brief Search a pattern in the text using Boyer Moore algorithm
+ *        (build a bad character shifts array and good prefixes shift array)
+ *
+ * \param text Text to search in
+ * \param textlen length of the text
+ * \param needle pattern to search for
+ * \param needlelen length of the pattern
+ */
+static inline uint8_t *BoyerMooreSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen) {
+    int32_t bmBc[ALPHABET_SIZE];
+    int32_t *bmGs = SCMalloc(sizeof(int32_t)*(needlelen + 1));
+
+    PreBmGs(needle, needlelen, bmGs);
+    PreBmBc(needle, needlelen, bmBc);
+
+    uint8_t *ret = BoyerMoore(needle, needlelen, text, textlen, bmGs, bmBc);
+    SCFree(bmGs);
+
+    return ret;
+}
+
+/**
+ * \brief Search a pattern in the text using Boyer Moore nocase algorithm
+ *        (build a bad character shifts array and good prefixes shift array)
+ *
+ * \param text Text to search in
+ * \param textlen length of the text
+ * \param needle pattern to search for
+ * \param needlelen length of the pattern
+ */
+static inline uint8_t *BoyerMooreNocaseSearch(uint8_t *text, uint32_t textlen, uint8_t *needle, uint32_t needlelen) {
+    int32_t bmBc[ALPHABET_SIZE];
+    int32_t *bmGs = SCMalloc(sizeof(int32_t)*(needlelen + 1));
+
+    PreBmGsNocase(needle, needlelen, bmGs);
+    PreBmBcNocase(needle, needlelen, bmBc);
+
+    uint8_t *ret = BoyerMooreNocase(needle, needlelen, text, textlen, bmGs, bmBc);
+    SCFree(bmGs);
+
+    return ret;
+}
+
+
 #endif /* __UTIL_SPM_H__ */
-- 
1.6.0.4

