The probing parser currently doesn't report a direction. On a TCP session picked up midstream whose first data is such a request seen to the client, the flow isn't reversed and the request goes to the response parser. Giuseppe Longo
AppLayerHandleUdp reverses a UDP flow whenever protocol detection asks for it, even if a protocol was already detected and parsed on the other direction. TCP only reverses while the other direction is unknown. Example, SIP over UDP ...Giuseppe Longo
RFC3261 requires exactly one space between the fields of the requests and responses but I've realized, looking at the pcap in https://redmine.openinfosecfoundation.org/issues/9135, that some implementations may send several, and servers ...Giuseppe Longo
SIP transactions are logged with the addresses of the packet that triggers logging. Each message should be logged with its actual sender, including requests sent by the server side.Giuseppe Longo
Events are set on the last transaction of the state. If the message in error is the first one of the flow, there's no transaction yet and the event is silently dropped. Otherwise it's set on an earlier transaction, possibly of the other ...Giuseppe Longo
Requests are only parsed in the to-server direction and responses in the to-client direction, but both SIP endpoints can send requests, for example a callee ending a call with BYE. These valid messages are reported as invalid_data, and ...Giuseppe Longo
SIP methods whose pattern is confirmed by a probing parser are only detected when the whole request line is in the first segment. The SIP probe is registered with pp_max_depth 0, so it gives up as soon as the request line is incomplete. ...Giuseppe Longo