Suricata

While creating a new transaction in the DCERPC parser, the default constructor unconditionally sets the tx PDU to request/response. There are several different types of PDU available in DCERPC. Moreover, the PDU type information must be available at this point from the header as the transaction creation only happens after the header is successfully parsed. While matching on PDU types, this can result in incorrect matches on the defaults when say a request of type BIND was seen but the transaction carried response of type RESPONSE and matched on it.