Suricata

DCERPC parser only handles and logs 3 types of request/response pairs:
1. REQUEST/RESPONSE
2. BIND/BIND_ACK
3. ALTER_CONTEXT/ALTER_CONTEXT_RESP

All the other unhandled types that are parsed from the header are not even logged/available for matching through keywords like dcerpc.ptype. DCERPC parser should create a record of these PDU types and allow for matching on the header fields at least even if it cannot handle the rest of the fragment.