Suricata

Suricata dcerpc output doesn't contain the opnum for the procedure call, in this example 15 (NetShareEnum). Full smb log is attached along with the pcap.

{
  "timestamp": "2016-10-16T08:16:01.434363+0000",
  "flow_id": 1881918157182233,
  "pcap_cnt": 874,
  "event_type": "smb",
  "src_ip": "192.168.199.132",
  "src_port": 49675,
  "dest_ip": "192.168.199.133",
  "dest_port": 445,
  "proto": "TCP",
  "smb": {
    "id": 8,
    "dialect": "3.11",
    "command": "SMB2_COMMAND_WRITE",
    "status": "STATUS_SUCCESS",
    "status_code": "0x0",
    "session_id": 127543348822037,
    "tree_id": 1,
    "dcerpc": {
      "request": "BIND",
      "response": "BINDACK",
      "interfaces": [
        {
          "uuid": "4b324fc8-1670-01d3-1278-5a47bf6ee188",
          "version": "3.0",
          "ack_result": 2,
          "ack_reason": 0
        },
        {
          "uuid": "4b324fc8-1670-01d3-1278-5a47bf6ee188",
          "version": "3.0",
          "ack_result": 0,
          "ack_reason": 0
        },
        {
          "uuid": "4b324fc8-1670-01d3-1278-5a47bf6ee188",
          "version": "3.0",
          "ack_result": 3,
          "ack_reason": 0
        }
      ],
      "call_id": 2
    }
  },
  "host": "roundrob2_eint" 
}

Logging has been added to DCERPC now. It does log the opnum for requests now: https://github.com/OISF/suricata/pull/5190/commits/9f9670ebdc5ea15ccc35274dd48ca00165dcbe51
s-v test for the same: https://github.com/OISF/suricata-verify/tree/master/tests/dcerpc/dce-logging