tweaking frag. FragStart had the wrong start point

diff --git a/src/stream/base/stream_base.cc b/src/stream/base/stream_base.cc
index 565d3cf0c14bae085b596732c62b82b94d56849c..187746b81e402a618a7d2536ea268442b05153a3 100644 (file)
--- a/src/stream/base/stream_base.cc
+++ b/src/stream/base/stream_base.cc
@@ -249,7 +249,7 @@ void StreamBase::eval(Packet *p)
         break;
 
     case PktType::IP:
-        if ( p->ptrs.ip_api.is_valid() )
+        if ( p->has_ip() )
             flow_con->process_ip(p);
         break;
 

diff --git a/src/stream/ip/ip_defrag.cc b/src/stream/ip/ip_defrag.cc
index 895af773570c375072b12d87ead742f5ea3d1a34..bc5b679c21b8c3a1c1f22dbfa4584bc95d57b708 100644 (file)
--- a/src/stream/ip/ip_defrag.cc
+++ b/src/stream/ip/ip_defrag.cc
@@ -1567,16 +1567,13 @@ int Defrag::insert(Packet *p, FragTracker *ft, FragEngine *fe)
      */
     firstLastOk = FragCheckFirstLast(p, ft, net_frag_offset);
 
-    // if we're here, then the last layer was a fragment.
-    const Layer& lyr = p->layers[p->num_layers-1];
-    fragStart = lyr.start + lyr.length;
-
     /* Use the actual length here because packet may have been
      * truncated.  Don't want to try to copy more than we actually
      * captured. Use dsize as the frag length since it is distance
      * between the last sucesfully decoded layer (which is ip6_frag
      *  or ipv4) and the end of packet, */
     len = fragLength = p->dsize;
+    fragStart = p->data;
 
     /*
      * setup local variables for tracking this frag