From: Josh <jrosenba@cisco.com>
Date: Fri, 3 Oct 2014 15:54:04 +0000 (-0500)
Subject: seperating Decode Data from Codec
X-Git-Tag: 3.0.0-233~1397^2~19^2~1^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7976309460f65dff6167b9eff3f0cbf8a67880f3;p=thirdparty%2Fsnort3.git

seperating Decode Data from Codec
---

diff --git a/CMakeLists.txt b/CMakeLists.txt
index d0d7c048a..0f82d34f7 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -34,9 +34,7 @@ add_subdirectory (lua)
 add_subdirectory (doc)
 
 
-
 # Miscelaneous stuff.  Does NOT directly effect snort's building environment
-
 include (cmake/packaging_data.cmake)
 include (cmake/create_pkg_config.cmake)
 
@@ -51,7 +49,7 @@ add_custom_target(uninstall
     COMMAND ${CMAKE_COMMAND} -P ${CMAKE_CURRENT_BINARY_DIR}/cmake_uninstall.cmake)
 
 
-# Test Plugins!!
+# Test plugins in the 'Extra' directory!!
 if (BUILD_EXTRA_PLUGINS)
     if (${CMAKE_GENERATOR} MATCHES "Make")
         add_subdirectory(extra)
diff --git a/extra/CMakeLists.txt b/extra/CMakeLists.txt
index 1271063ec..7bc7539d7 100644
--- a/extra/CMakeLists.txt
+++ b/extra/CMakeLists.txt
@@ -33,6 +33,7 @@ else (BUILD_EXTRA_PLUGINS)
 
 
     # Some shared library flags for the two platforms which I am using
+    include(CheckCXXCompilerFlag)
     set(CMAKE_REQUIRED_FLAGS "-Wl,-undefined,dynamic_lookup")
     check_cxx_compiler_flag("" HAVE_DYNAMIC_LOOKUP)
     if(HAVE_DYNAMIC_LOOKUP)
diff --git a/extra/FindSNORT.cmake b/extra/FindSNORT.cmake
index d448073a3..99c17ca09 100644
--- a/extra/FindSNORT.cmake
+++ b/extra/FindSNORT.cmake
@@ -20,6 +20,7 @@ set(ERROR_MESSAGE
           -DSNORT_INCLUDE_DIR:PATH=/full/path/to/snort/include/dir
 
     3)  set the environment variable SNORT_DIR
+
     "
 )
 
diff --git a/extra/src/inspectors/dpx.cc b/extra/src/inspectors/dpx.cc
index 8da9d4328..2ba8672cf 100644
--- a/extra/src/inspectors/dpx.cc
+++ b/extra/src/inspectors/dpx.cc
@@ -94,7 +94,7 @@ void DpxPH::show(SnortConfig*)
 void DpxPH::eval(Packet* p)
 {
     // precondition - what we registered for
-    assert(IsUDP(p));
+    assert(p->is_udp());
 
     if ( p->ptrs.dp == port && p->dsize > max )
         SnortEventqAdd(DPX_GID, DPX_SID);
diff --git a/src/codecs/ip/cd_auth.cc b/src/codecs/ip/cd_auth.cc
index eecb2d925..97341af01 100644
--- a/src/codecs/ip/cd_auth.cc
+++ b/src/codecs/ip/cd_auth.cc
@@ -67,7 +67,7 @@ public:
     ~AuthCodec(){};
 
     virtual void get_protocol_ids(std::vector<uint16_t>& v);
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
 };
 
 /*  Valid for both IPv4 and IPv6 */
@@ -92,7 +92,7 @@ void AuthCodec::get_protocol_ids(std::vector<uint16_t>& v)
     v.push_back(IPPROTO_ID_AUTH);
 }
 
-bool AuthCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort)
+bool AuthCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
 {
 
     const AuthHdr* const ah = reinterpret_cast<const AuthHdr* const>(raw.data);
diff --git a/src/codecs/ip/cd_dst_opts.cc b/src/codecs/ip/cd_dst_opts.cc
index 0f313e99f..e6326620a 100644
--- a/src/codecs/ip/cd_dst_opts.cc
+++ b/src/codecs/ip/cd_dst_opts.cc
@@ -46,7 +46,7 @@ public:
 
 
     virtual void get_protocol_ids(std::vector<uint16_t>& v);
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
     virtual bool update(Packet*, Layer*, uint32_t* len);
 
 };
@@ -62,7 +62,7 @@ struct IP6Dest
 } // anonymous namespace
 
 
-bool Ipv6DSTOptsCodec::decode(const RawData& raw, CodecData& codec, SnortData&)
+bool Ipv6DSTOptsCodec::decode(const RawData& raw, CodecData& codec, DecodeData&)
 {
     const IP6Dest* const dsthdr = reinterpret_cast<const IP6Dest *>(raw.data);
 
diff --git a/src/codecs/ip/cd_esp.cc b/src/codecs/ip/cd_esp.cc
index 8d8ff71e6..ef6b554c9 100644
--- a/src/codecs/ip/cd_esp.cc
+++ b/src/codecs/ip/cd_esp.cc
@@ -81,7 +81,7 @@ public:
 
 
     virtual void get_protocol_ids(std::vector<uint16_t>& v);
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
 };
 
 
@@ -109,7 +109,7 @@ void EspCodec::get_protocol_ids(std::vector<uint16_t>& v)
  *          the encryption type (or lack thereof).
  *
  */
-bool EspCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort)
+bool EspCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
 {
     const uint8_t *esp_payload;
     uint8_t pad_length;
diff --git a/src/codecs/ip/cd_frag.cc b/src/codecs/ip/cd_frag.cc
index 9e6beadac..fff9b574d 100644
--- a/src/codecs/ip/cd_frag.cc
+++ b/src/codecs/ip/cd_frag.cc
@@ -49,7 +49,7 @@ public:
     ~Ipv6FragCodec() {};
 
 
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
 
     virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/,
                     const Packet* const);
@@ -61,7 +61,7 @@ public:
 } // namespace
 
 
-bool Ipv6FragCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort)
+bool Ipv6FragCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
 {
     const ip::IP6Frag* const ip6frag_hdr = reinterpret_cast<const ip::IP6Frag*>(raw.data);
 
diff --git a/src/codecs/ip/cd_gre.cc b/src/codecs/ip/cd_gre.cc
index 9d7a11a96..20387cbbe 100644
--- a/src/codecs/ip/cd_gre.cc
+++ b/src/codecs/ip/cd_gre.cc
@@ -64,7 +64,7 @@ public:
     ~GreCodec(){};
 
     virtual void get_protocol_ids(std::vector<uint16_t>& v);
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
      void log(TextLog* const, const uint8_t* /*raw_pkt*/,
                     const Packet* const);
 };
@@ -111,7 +111,7 @@ void GreCodec::get_protocol_ids(std::vector<uint16_t>& v)
  *
  * Notes: see RFCs 1701, 2784 and 2637
  */
-bool GreCodec::decode(const RawData& raw, CodecData& codec, SnortData&)
+bool GreCodec::decode(const RawData& raw, CodecData& codec, DecodeData&)
 {
     if (raw.len < GRE_HEADER_LEN)
     {
diff --git a/src/codecs/ip/cd_hop_opts.cc b/src/codecs/ip/cd_hop_opts.cc
index d9139576e..87be09e53 100644
--- a/src/codecs/ip/cd_hop_opts.cc
+++ b/src/codecs/ip/cd_hop_opts.cc
@@ -46,7 +46,7 @@ public:
     ~Ipv6HopOptsCodec() {};
 
     virtual void get_protocol_ids(std::vector<uint16_t>& v);
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
     virtual bool update(Packet*, Layer*, uint32_t* len);
 };
 
@@ -67,7 +67,7 @@ struct IP6HopByHop
  * Class functions
  */
 
-bool Ipv6HopOptsCodec::decode(const RawData& raw, CodecData& codec, SnortData&)
+bool Ipv6HopOptsCodec::decode(const RawData& raw, CodecData& codec, DecodeData&)
 {
     const IP6HopByHop *hbh_hdr = reinterpret_cast<const IP6HopByHop*>(raw.data);
 
diff --git a/src/codecs/ip/cd_icmp4.cc b/src/codecs/ip/cd_icmp4.cc
index e44f0dd6a..35e481e80 100644
--- a/src/codecs/ip/cd_icmp4.cc
+++ b/src/codecs/ip/cd_icmp4.cc
@@ -91,14 +91,14 @@ public:
     ~Icmp4Codec() {};
     
     virtual void get_protocol_ids(std::vector<uint16_t>&);
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
     virtual bool update(Packet*, Layer*, uint32_t* len);
     virtual void format(EncodeFlags, const Packet* p, Packet* c, Layer*);
     virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/,
                     const Packet* const);
 
 private:
-    void ICMP4AddrTests(const SnortData& snort, const CodecData& codec);
+    void ICMP4AddrTests(const DecodeData& snort, const CodecData& codec);
     void ICMP4MiscTests(const ICMPHdr* const, const CodecData&, const uint16_t);
 
 };
@@ -126,7 +126,7 @@ void Icmp4Codec::get_protocol_ids(std::vector<uint16_t> &v)
  *
  * Returns: void function
  */
-bool Icmp4Codec::decode(const RawData& raw, CodecData& codec,SnortData& snort)
+bool Icmp4Codec::decode(const RawData& raw, CodecData& codec,DecodeData& snort)
 {
 
     if(raw.len < icmp::ICMP_HEADER_LEN)
@@ -246,7 +246,7 @@ bool Icmp4Codec::decode(const RawData& raw, CodecData& codec,SnortData& snort)
     return true;
 }
 
-void Icmp4Codec::ICMP4AddrTests(const SnortData& snort, const CodecData& codec)
+void Icmp4Codec::ICMP4AddrTests(const DecodeData& snort, const CodecData& codec)
 {
     uint32_t dst = snort.ip_api.get_dst()->ip32[0];
 
diff --git a/src/codecs/ip/cd_icmp6.cc b/src/codecs/ip/cd_icmp6.cc
index 485f40fb0..0687192d7 100644
--- a/src/codecs/ip/cd_icmp6.cc
+++ b/src/codecs/ip/cd_icmp6.cc
@@ -79,7 +79,7 @@ public:
 
 
     virtual void get_protocol_ids(std::vector<uint16_t>& v);
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
     virtual bool update(Packet*, Layer*, uint32_t* len);
     virtual void format(EncodeFlags, const Packet*, Packet*, Layer*);
     virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/,
@@ -97,7 +97,7 @@ void Icmp6Codec::get_protocol_ids(std::vector<uint16_t>& v)
 // decode.c::ICMP6
 //--------------------------------------------------------------------
 
-bool Icmp6Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort)
+bool Icmp6Codec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
 {
     if(raw.len < icmp::ICMP6_HEADER_MIN_LEN)
     {
diff --git a/src/codecs/ip/cd_igmp.cc b/src/codecs/ip/cd_igmp.cc
index 9062f3296..24412a765 100644
--- a/src/codecs/ip/cd_igmp.cc
+++ b/src/codecs/ip/cd_igmp.cc
@@ -62,7 +62,7 @@ public:
     ~IgmpCodec() {};
 
 
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
 
     virtual void get_protocol_ids(std::vector<uint16_t>&);
     virtual void get_data_link_type(std::vector<int>&){};
@@ -76,7 +76,7 @@ public:
 
 
 
-bool IgmpCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort)
+bool IgmpCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
 {
     if (snort.ip_api.is_ip4() && raw.len >= 1 && raw.data[0] == 0x11)
     {
diff --git a/src/codecs/ip/cd_ipv4.cc b/src/codecs/ip/cd_ipv4.cc
index f8e264ac1..8bb936f2e 100644
--- a/src/codecs/ip/cd_ipv4.cc
+++ b/src/codecs/ip/cd_ipv4.cc
@@ -100,7 +100,7 @@ public:
     ~Ipv4Codec(){};
 
     virtual void get_protocol_ids(std::vector<uint16_t>& v);
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
     virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/,
         const Packet* const);
     virtual bool encode(const uint8_t* const raw_in, const uint16_t raw_len,
@@ -135,7 +135,7 @@ void Ipv4Codec::get_protocol_ids(std::vector<uint16_t>& v)
 }
 
 
-bool Ipv4Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort)
+bool Ipv4Codec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
 {
     uint32_t ip_len; /* length from the start of the ip hdr to the pkt end */
     uint16_t hlen;  /* ip header length */
diff --git a/src/codecs/ip/cd_ipv6.cc b/src/codecs/ip/cd_ipv6.cc
index 130ae4754..bd68fe5ff 100644
--- a/src/codecs/ip/cd_ipv6.cc
+++ b/src/codecs/ip/cd_ipv6.cc
@@ -93,7 +93,7 @@ public:
     ~Ipv6Codec(){};
 
     virtual void get_protocol_ids(std::vector<uint16_t>& v);
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
     virtual bool encode(const uint8_t* const raw_in, const uint16_t raw_len,
                         EncState&, Buffer&);
     virtual bool update(Packet*, Layer*, uint32_t* len);
@@ -107,9 +107,9 @@ public:
 
 
 static inline void IPV6CheckIsatap(const ip::IP6Hdr* const,
-                                    const SnortData&,
+                                    const DecodeData&,
                                     const CodecData&);
-static inline void IPV6MiscTests(const SnortData&, const CodecData&);
+static inline void IPV6MiscTests(const DecodeData&, const CodecData&);
 static void CheckIPV6Multicast(const ip::IP6Hdr* const, const CodecData&);
 static inline bool CheckTeredoPrefix(const ip::IP6Hdr* const hdr);
 
@@ -124,7 +124,7 @@ void Ipv6Codec::get_protocol_ids(std::vector<uint16_t>& v)
 }
 
 
-bool Ipv6Codec::decode(const RawData& raw, CodecData& codec, SnortData& snort)
+bool Ipv6Codec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
 {
     // FIXIT-L -J necessary for scoping until the 'goto' statements are deleted
     {
@@ -224,7 +224,7 @@ decodeipv6_fail:
 }
 
 static inline void IPV6CheckIsatap(const ip::IP6Hdr* const ip6h,
-                                    const SnortData& snort,
+                                    const DecodeData& snort,
                                     const CodecData& codec)
 {
     /* Only check for IPv6 over IPv4 */
@@ -250,7 +250,7 @@ static inline void IPV6CheckIsatap(const ip::IP6Hdr* const ip6h,
  *
  * Returns: void function
  */
-static inline void IPV6MiscTests(const SnortData& snort, const CodecData& codec)
+static inline void IPV6MiscTests(const DecodeData& snort, const CodecData& codec)
 {
     const sfip_t *ip_src = snort.ip_api.get_src();
     const sfip_t *ip_dst = snort.ip_api.get_dst();
diff --git a/src/codecs/ip/cd_mobility.cc b/src/codecs/ip/cd_mobility.cc
index 717df0a00..a27fdd944 100644
--- a/src/codecs/ip/cd_mobility.cc
+++ b/src/codecs/ip/cd_mobility.cc
@@ -42,7 +42,7 @@ public:
 
 
     virtual void get_protocol_ids(std::vector<uint16_t>&);
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
 };
 
 } // namespace
@@ -53,7 +53,7 @@ void MobilityCodec::get_protocol_ids(std::vector<uint16_t>& v)
     v.push_back(IPPROTO_ID_MOBILITY);
 }
 
-bool MobilityCodec::decode(const RawData&, CodecData& codec, SnortData&)
+bool MobilityCodec::decode(const RawData&, CodecData& codec, DecodeData&)
 {
     codec_events::decoder_event(codec, DECODE_IP_BAD_PROTO);
     codec.proto_bits |= PROTO_BIT__IP6_EXT; // check for any IP related rules
diff --git a/src/codecs/ip/cd_no_next.cc b/src/codecs/ip/cd_no_next.cc
index e1b4f4cea..68c3032b1 100644
--- a/src/codecs/ip/cd_no_next.cc
+++ b/src/codecs/ip/cd_no_next.cc
@@ -45,7 +45,7 @@ public:
     ~Ipv6NoNextCodec() {};
 
 
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
     virtual void get_protocol_ids(std::vector<uint16_t>&);    
 };
 
@@ -53,7 +53,7 @@ public:
 } // namespace
 
 
-bool Ipv6NoNextCodec::decode(const RawData& raw, CodecData& codec, SnortData&)
+bool Ipv6NoNextCodec::decode(const RawData& raw, CodecData& codec, DecodeData&)
 {
     // No need ot check IPv6 extension order since this is automatically
     // the last extension.
diff --git a/src/codecs/ip/cd_pgm.cc b/src/codecs/ip/cd_pgm.cc
index cda4988f7..265886e62 100644
--- a/src/codecs/ip/cd_pgm.cc
+++ b/src/codecs/ip/cd_pgm.cc
@@ -59,7 +59,7 @@ public:
     PgmCodec() : Codec(CD_PGM_NAME){};
     ~PgmCodec() {};
 
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
     virtual void get_protocol_ids(std::vector<uint16_t>&);
 };
 
@@ -151,7 +151,7 @@ static inline int pgm_nak_detect (const RawData& raw)
 // private functions
 //-------------------------------------------------------------------------
 
-bool PgmCodec::decode(const RawData& raw, CodecData& codec, SnortData&)
+bool PgmCodec::decode(const RawData& raw, CodecData& codec, DecodeData&)
 {
     if ( pgm_nak_detect(raw) == PGM_NAK_VULN )
         codec_events::decoder_event(codec, DECODE_PGM_NAK_OVERFLOW);
diff --git a/src/codecs/ip/cd_routing.cc b/src/codecs/ip/cd_routing.cc
index a1085c810..019a18908 100644
--- a/src/codecs/ip/cd_routing.cc
+++ b/src/codecs/ip/cd_routing.cc
@@ -47,7 +47,7 @@ public:
     ~Ipv6RoutingCodec() {};
 
 
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
 
     virtual void get_protocol_ids(std::vector<uint16_t>&);    
 };
@@ -78,7 +78,7 @@ struct IP6Route0
 } // namespace
 
 
-bool Ipv6RoutingCodec::decode(const RawData& raw, CodecData& codec, SnortData&)
+bool Ipv6RoutingCodec::decode(const RawData& raw, CodecData& codec, DecodeData&)
 {
     const IP6Route* const rte = reinterpret_cast<const IP6Route *>(raw.data);
 
diff --git a/src/codecs/ip/cd_sun_nd.cc b/src/codecs/ip/cd_sun_nd.cc
index a03c36b88..a097c2e17 100644
--- a/src/codecs/ip/cd_sun_nd.cc
+++ b/src/codecs/ip/cd_sun_nd.cc
@@ -43,7 +43,7 @@ public:
 
 
     virtual void get_protocol_ids(std::vector<uint16_t>&);
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
 
 };
 
@@ -57,7 +57,7 @@ void SunNdCodec::get_protocol_ids(std::vector<uint16_t>& v)
     v.push_back(IPPROTO_ID_SUN_ND);
 }
 
-bool SunNdCodec::decode(const RawData&, CodecData& codec, SnortData&)
+bool SunNdCodec::decode(const RawData&, CodecData& codec, DecodeData&)
 {
     codec_events::decoder_event(codec, DECODE_IP_BAD_PROTO);
     return true;
diff --git a/src/codecs/ip/cd_swipe.cc b/src/codecs/ip/cd_swipe.cc
index 6d98acb9c..d7143d58d 100644
--- a/src/codecs/ip/cd_swipe.cc
+++ b/src/codecs/ip/cd_swipe.cc
@@ -40,7 +40,7 @@ public:
     virtual ~SwipeCodec(){};
     
     virtual void get_protocol_ids(std::vector<uint16_t>& v);
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
 };
 
 } // namespace
@@ -53,7 +53,7 @@ void SwipeCodec::get_protocol_ids(std::vector<uint16_t> &proto_ids)
 }
 
 
-bool SwipeCodec::decode(const RawData&, CodecData& codec, SnortData&)
+bool SwipeCodec::decode(const RawData&, CodecData& codec, DecodeData&)
 {
     // currently unsupported
     codec_events::decoder_event(codec, DECODE_IP_BAD_PROTO);
diff --git a/src/codecs/ip/cd_tcp.cc b/src/codecs/ip/cd_tcp.cc
index 529a313c9..81c09669c 100644
--- a/src/codecs/ip/cd_tcp.cc
+++ b/src/codecs/ip/cd_tcp.cc
@@ -97,7 +97,7 @@ public:
     virtual void get_protocol_ids(std::vector<uint16_t>& v);
     virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/,
                     const Packet* const);
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
     virtual bool encode(const uint8_t* const raw_in, const uint16_t raw_len,
                         EncState&, Buffer&);
     virtual bool update(Packet*, Layer*, uint32_t* len);
@@ -117,7 +117,7 @@ static int OptLenValidate(const tcp::TcpOption* const opt,
 
 static void DecodeTCPOptions(const uint8_t *, uint32_t, CodecData&);
 static inline void TCPMiscTests(const tcp::TCPHdr* const tcph,
-                                const SnortData& snort,
+                                const DecodeData& snort,
                                 const CodecData& codec);
 
 void TcpCodec::get_protocol_ids(std::vector<uint16_t>& v)
@@ -125,7 +125,7 @@ void TcpCodec::get_protocol_ids(std::vector<uint16_t>& v)
     v.push_back(IPPROTO_ID_TCP);
 }
 
-bool TcpCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort)
+bool TcpCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
 {
     if(raw.len < tcp::TCP_HEADER_LEN)
     {
@@ -521,7 +521,7 @@ static int OptLenValidate(const tcp::TcpOption* const opt,
 
 /* TCP-layer decoder alerts */
 static inline void TCPMiscTests(const tcp::TCPHdr* const tcph,
-                                const SnortData& snort,
+                                const DecodeData& snort,
                                 const CodecData& codec)
 {
     if ( ((tcph->th_flags & TH_NORESERVED) == TH_SYN ) &&
diff --git a/src/codecs/ip/cd_udp.cc b/src/codecs/ip/cd_udp.cc
index 15cbc9a17..b3a103a1b 100644
--- a/src/codecs/ip/cd_udp.cc
+++ b/src/codecs/ip/cd_udp.cc
@@ -120,7 +120,7 @@ public:
 
 
     virtual void get_protocol_ids(std::vector<uint16_t>& v);
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
 
     virtual bool encode(const uint8_t* const raw_in, const uint16_t raw_len,
                         EncState&, Buffer&);
@@ -137,7 +137,7 @@ public:
 
 
 
-static inline void UDPMiscTests(const SnortData&,
+static inline void UDPMiscTests(const DecodeData&,
                                 const CodecData&,
                                 uint32_t pay_len);
 
@@ -150,7 +150,7 @@ void UdpCodec::get_protocol_ids(std::vector<uint16_t>& v)
 }
 
 
-bool UdpCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort)
+bool UdpCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
 {
     uint16_t uhlen;
     bool fragmented_udp_flag = false;
@@ -316,7 +316,7 @@ bool UdpCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort)
 
 
 /* UDP-layer decoder alerts */
-static inline void UDPMiscTests(const SnortData& snort,
+static inline void UDPMiscTests(const DecodeData& snort,
                                 const CodecData& codec,
                                 uint32_t pay_len)
 {
diff --git a/src/codecs/link/cd_arp.cc b/src/codecs/link/cd_arp.cc
index eef4d24df..d9b715ca6 100644
--- a/src/codecs/link/cd_arp.cc
+++ b/src/codecs/link/cd_arp.cc
@@ -56,7 +56,7 @@ public:
     ~ArpCodec(){};
 
     virtual void get_protocol_ids(std::vector<uint16_t>& v);
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
     virtual void format(EncodeFlags, const Packet*, Packet*, Layer*);
 };
 
@@ -87,7 +87,7 @@ void ArpCodec::get_protocol_ids(std::vector<uint16_t>& v)
  *
  * Returns: void function
  */
-bool ArpCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort)
+bool ArpCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
 {
     if(raw.len < sizeof(arp::EtherARP))
     {
diff --git a/src/codecs/link/cd_eapol.cc b/src/codecs/link/cd_eapol.cc
index 81b672886..738882882 100644
--- a/src/codecs/link/cd_eapol.cc
+++ b/src/codecs/link/cd_eapol.cc
@@ -61,7 +61,7 @@ public:
     ~EapolCodec() {};
 
 
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
     virtual void get_protocol_ids(std::vector<uint16_t>&);
 };
 
@@ -111,7 +111,7 @@ void DecodeEapolKey(const RawData& raw, const CodecData& codec)
  ************** main codec functions  ************
  *************************************************/
 
-bool EapolCodec::decode(const RawData& raw, CodecData& codec, SnortData&)
+bool EapolCodec::decode(const RawData& raw, CodecData& codec, DecodeData&)
 {
     const eapol::EtherEapol* const eplh =
         reinterpret_cast<const eapol::EtherEapol*>(raw.data);
diff --git a/src/codecs/link/cd_erspan2.cc b/src/codecs/link/cd_erspan2.cc
index 9b3313875..2f2a47003 100644
--- a/src/codecs/link/cd_erspan2.cc
+++ b/src/codecs/link/cd_erspan2.cc
@@ -56,7 +56,7 @@ public:
     ~Erspan2Codec(){};
 
     virtual void get_protocol_ids(std::vector<uint16_t>& v);
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
     
 };
 
@@ -95,7 +95,7 @@ void Erspan2Codec::get_protocol_ids(std::vector<uint16_t>& v)
  * Returns: void function
  *
  */
-bool Erspan2Codec::decode(const RawData& raw, CodecData& codec, SnortData& )
+bool Erspan2Codec::decode(const RawData& raw, CodecData& codec, DecodeData& )
 {
     const ERSpanType2Hdr* const erSpan2Hdr =
         reinterpret_cast<const ERSpanType2Hdr*>(raw.data);
diff --git a/src/codecs/link/cd_erspan3.cc b/src/codecs/link/cd_erspan3.cc
index e75d40b35..fe7301db8 100644
--- a/src/codecs/link/cd_erspan3.cc
+++ b/src/codecs/link/cd_erspan3.cc
@@ -58,7 +58,7 @@ public:
 
 
     virtual void get_protocol_ids(std::vector<uint16_t>& v);
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
 };
 
 
@@ -107,7 +107,7 @@ void Erspan3Codec::get_protocol_ids(std::vector<uint16_t>& v)
  * Returns: void function
  *
  */
-bool Erspan3Codec::decode(const RawData& raw, CodecData& codec, SnortData&)
+bool Erspan3Codec::decode(const RawData& raw, CodecData& codec, DecodeData&)
 {
     const ERSpanType3Hdr* const erSpan3Hdr =
         reinterpret_cast<const ERSpanType3Hdr*>(raw.data);
diff --git a/src/codecs/link/cd_mpls.cc b/src/codecs/link/cd_mpls.cc
index aa0e4b464..308f71771 100644
--- a/src/codecs/link/cd_mpls.cc
+++ b/src/codecs/link/cd_mpls.cc
@@ -116,7 +116,7 @@ public:
     ~MplsCodec(){};
 
     virtual void get_protocol_ids(std::vector<uint16_t>& v);
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
     virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/,
         const Packet* const);
 };
@@ -140,7 +140,7 @@ void MplsCodec::get_protocol_ids(std::vector<uint16_t>& v)
 }
 
 
-bool MplsCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort)
+bool MplsCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
 {
     uint32_t mpls_h;
     uint32_t label;
diff --git a/src/codecs/link/cd_ppp_encap.cc b/src/codecs/link/cd_ppp_encap.cc
index 177d4eccb..961287037 100644
--- a/src/codecs/link/cd_ppp_encap.cc
+++ b/src/codecs/link/cd_ppp_encap.cc
@@ -42,7 +42,7 @@ public:
     ~PppEncap(){};
 
     virtual void get_protocol_ids(std::vector<uint16_t>& v);
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
 };
 
 const static uint16_t PPP_IP = 0x0021;       /* Internet Protocol */
@@ -71,7 +71,7 @@ void PppEncap::get_protocol_ids(std::vector<uint16_t>& v)
  *
  * Returns: void function
  */
-bool PppEncap::decode(const RawData& raw, CodecData& codec, SnortData&)
+bool PppEncap::decode(const RawData& raw, CodecData& codec, DecodeData&)
 {
     static THREAD_LOCAL bool had_vj = false;
     uint16_t protocol;
diff --git a/src/codecs/link/cd_pppoe.cc b/src/codecs/link/cd_pppoe.cc
index 5dcd0b8ae..c70e94762 100644
--- a/src/codecs/link/cd_pppoe.cc
+++ b/src/codecs/link/cd_pppoe.cc
@@ -106,7 +106,7 @@ constexpr uint16_t PPPoE_TAG_GENERIC_ERROR = 0x0203;
 
 static inline bool pppoepkt_decode(const RawData& raw,
                                     CodecData& codec,
-                                    SnortData&,
+                                    DecodeData&,
                                     PppoepktType ppp_type)
 {
     /* do a little validation */
@@ -297,7 +297,7 @@ public:
 
 
     virtual void get_protocol_ids(std::vector<uint16_t>& v);
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
     virtual bool encode(const uint8_t* const raw_in, const uint16_t raw_len,
                         EncState&, Buffer&);
 };
@@ -311,7 +311,7 @@ void PPPoEDiscCodec::get_protocol_ids(std::vector<uint16_t>& v)
 }
 
 
-bool PPPoEDiscCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort)
+bool PPPoEDiscCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
 {
     return pppoepkt_decode(raw, codec, snort, PppoepktType::DISCOVERY);
 }
@@ -392,7 +392,7 @@ public:
 
 
     virtual void get_protocol_ids(std::vector<uint16_t>& v);
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
     virtual bool encode(const uint8_t* const raw_in, const uint16_t raw_len,
                         EncState&, Buffer&);
 };
@@ -404,7 +404,7 @@ void PPPoESessCodec::get_protocol_ids(std::vector<uint16_t>& v)
 { v.push_back(ETHERNET_TYPE_PPPoE_SESS); }
 
 
-bool PPPoESessCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort)
+bool PPPoESessCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
 { return pppoepkt_decode(raw, codec, snort, PppoepktType::SESSION); }
 
 
diff --git a/src/codecs/link/cd_trans_bridge.cc b/src/codecs/link/cd_trans_bridge.cc
index 5cb77f25c..a4ebcb6c6 100644
--- a/src/codecs/link/cd_trans_bridge.cc
+++ b/src/codecs/link/cd_trans_bridge.cc
@@ -48,7 +48,7 @@ public:
 
 
     virtual void get_protocol_ids(std::vector<uint16_t>& v);
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
     
 };
 
@@ -77,7 +77,7 @@ void TransbridgeCodec::get_protocol_ids(std::vector<uint16_t>& v)
  * convention needed to be changed and the stuff at the beginning
  * wasn't needed since we are already deep into the packet
  */
-bool TransbridgeCodec::decode(const RawData& raw, CodecData& codec, SnortData&)
+bool TransbridgeCodec::decode(const RawData& raw, CodecData& codec, DecodeData&)
 {
     if(raw.len < eth::ETH_HEADER_LEN)
     {
diff --git a/src/codecs/link/cd_vlan.cc b/src/codecs/link/cd_vlan.cc
index 35a907765..5d86707b3 100644
--- a/src/codecs/link/cd_vlan.cc
+++ b/src/codecs/link/cd_vlan.cc
@@ -66,7 +66,7 @@ public:
     ~VlanCodec(){};
 
     virtual void get_protocol_ids(std::vector<uint16_t>& v);
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
     virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/,
         const Packet* const);
 };
@@ -83,7 +83,7 @@ void VlanCodec::get_protocol_ids(std::vector<uint16_t>& v)
 }
 
 
-bool VlanCodec::decode(const RawData& raw, CodecData& codec, SnortData&)
+bool VlanCodec::decode(const RawData& raw, CodecData& codec, DecodeData&)
 {
     if(raw.len < sizeof(vlan::VlanTagHdr))
     {
diff --git a/src/codecs/misc/cd_default.cc b/src/codecs/misc/cd_default.cc
index 3a13a5b3c..46efaa8be 100644
--- a/src/codecs/misc/cd_default.cc
+++ b/src/codecs/misc/cd_default.cc
@@ -38,7 +38,7 @@ public:
     virtual void get_protocol_ids(std::vector<uint16_t>& v)
     { v.push_back(FINISHED_DECODE); }
 
-    virtual bool decode(const RawData&, CodecData&, SnortData&)
+    virtual bool decode(const RawData&, CodecData&, DecodeData&)
     { return false; };
 };
 
diff --git a/src/codecs/misc/cd_gtp.cc b/src/codecs/misc/cd_gtp.cc
index 6d5ad8721..29f992402 100644
--- a/src/codecs/misc/cd_gtp.cc
+++ b/src/codecs/misc/cd_gtp.cc
@@ -70,7 +70,7 @@ public:
     ~GtpCodec(){};
 
     virtual void get_protocol_ids(std::vector<uint16_t>& v);
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
     virtual bool encode(const uint8_t* const raw_in, const uint16_t raw_len,
                         EncState&, Buffer&);
     virtual bool update(Packet*, Layer*, uint32_t* len);
@@ -106,7 +106,7 @@ void GtpCodec::get_protocol_ids(std::vector<uint16_t>& v)
  *
  */
 
-bool GtpCodec::decode(const RawData& raw, CodecData& codec, SnortData&)
+bool GtpCodec::decode(const RawData& raw, CodecData& codec, DecodeData&)
 {
     uint8_t  next_hdr_type;
     uint8_t  version;
diff --git a/src/codecs/misc/cd_icmp4_ip.cc b/src/codecs/misc/cd_icmp4_ip.cc
index 55de33624..2d0a18640 100644
--- a/src/codecs/misc/cd_icmp4_ip.cc
+++ b/src/codecs/misc/cd_icmp4_ip.cc
@@ -28,11 +28,14 @@
 #include "framework/codec.h"
 #include "protocols/ipv4.h"
 #include "protocols/packet.h"
+#include "protocols/tcp.h"
 #include "codecs/codec_events.h"
 #include "log/text_log.h"
 #include "main/snort.h"
 #include "log/messages.h"
 #include "protocols/packet_manager.h"
+#include "protocols/icmp4.h"
+#include "protocols/udp.h"
 
 namespace
 {
@@ -48,7 +51,7 @@ public:
 
 
     virtual void get_protocol_ids(std::vector<uint16_t>&);
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
     virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/,
                     const Packet* const);
 };
@@ -61,7 +64,7 @@ void Icmp4IpCodec::get_protocol_ids(std::vector<uint16_t>& v)
     v.push_back(IP_EMBEDDED_IN_ICMP4);
 }
 
-bool Icmp4IpCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort)
+bool Icmp4IpCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
 {
     uint32_t ip_len;       /* length from the start of the ip hdr to the
                              * pkt end */
diff --git a/src/codecs/misc/cd_icmp6_ip.cc b/src/codecs/misc/cd_icmp6_ip.cc
index 8bc251a26..0be55eadf 100644
--- a/src/codecs/misc/cd_icmp6_ip.cc
+++ b/src/codecs/misc/cd_icmp6_ip.cc
@@ -54,7 +54,7 @@ public:
 
 
     virtual void get_protocol_ids(std::vector<uint16_t>&);
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
 };
 
 } // namespace
@@ -64,7 +64,7 @@ void Icmp6IpCodec::get_protocol_ids(std::vector<uint16_t>& v)
     v.push_back(IP_EMBEDDED_IN_ICMP6);
 }
 
-bool Icmp6IpCodec::decode(const RawData& raw, CodecData& codec, SnortData&)
+bool Icmp6IpCodec::decode(const RawData& raw, CodecData& codec, DecodeData&)
 {
 //    uint16_t orig_frag_offset;
 
diff --git a/src/codecs/misc/cd_llc.cc b/src/codecs/misc/cd_llc.cc
index 19e3416bf..0421081ee 100644
--- a/src/codecs/misc/cd_llc.cc
+++ b/src/codecs/misc/cd_llc.cc
@@ -50,7 +50,7 @@ public:
     ~LlcCodec() {};
 
 
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
 
     virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/,
         const Packet* const);
@@ -89,7 +89,7 @@ void LlcCodec::get_protocol_ids(std::vector<uint16_t>& v)
     v.push_back(ETHERNET_LLC);
 }
 
-bool LlcCodec::decode(const RawData& raw, CodecData& codec, SnortData&)
+bool LlcCodec::decode(const RawData& raw, CodecData& codec, DecodeData&)
 {
     if(raw.len < sizeof(EthLlc))
     {
diff --git a/src/codecs/misc/cd_teredo.cc b/src/codecs/misc/cd_teredo.cc
index 05aa7fea6..c509f1aed 100644
--- a/src/codecs/misc/cd_teredo.cc
+++ b/src/codecs/misc/cd_teredo.cc
@@ -50,7 +50,7 @@ public:
     ~TeredoCodec(){};
 
     virtual void get_protocol_ids(std::vector<uint16_t>& v);
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
 };
 
 } // anonymous namespace
@@ -61,7 +61,7 @@ void TeredoCodec::get_protocol_ids(std::vector<uint16_t>& v)
     v.push_back(PROTOCOL_TEREDO);
 }
 
-bool TeredoCodec::decode(const RawData& raw, CodecData& codec, SnortData& snort)
+bool TeredoCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort)
 {
     const uint8_t* raw_pkt = raw.data;
 
diff --git a/src/codecs/root/cd_eth.cc b/src/codecs/root/cd_eth.cc
index 793e3afb1..447c346e8 100644
--- a/src/codecs/root/cd_eth.cc
+++ b/src/codecs/root/cd_eth.cc
@@ -66,7 +66,7 @@ public:
     virtual void get_data_link_type(std::vector<int>&);
     virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/,
         const Packet*const );
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
     virtual bool encode(const uint8_t* const raw_in, const uint16_t raw_len,
                         EncState&, Buffer&);
     virtual bool update(Packet*, Layer*, uint32_t* len);
@@ -108,7 +108,7 @@ void EthCodec::get_protocol_ids(std::vector<uint16_t>&v)
  *
  * Returns: void function
  */
-bool EthCodec::decode(const RawData& raw, CodecData& codec, SnortData&)
+bool EthCodec::decode(const RawData& raw, CodecData& codec, DecodeData&)
 {
 
     /* do a little validation */
diff --git a/src/codecs/root/cd_i4l_rawip.cc b/src/codecs/root/cd_i4l_rawip.cc
index 74a79b316..6e9214d1a 100644
--- a/src/codecs/root/cd_i4l_rawip.cc
+++ b/src/codecs/root/cd_i4l_rawip.cc
@@ -45,7 +45,7 @@ public:
 
 
     virtual void get_data_link_type(std::vector<int>&);
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
 };
 
 
@@ -70,7 +70,7 @@ void I4LRawIpCodec::get_data_link_type(std::vector<int>& v)
  * Returns: void function
  */
 
-bool I4LRawIpCodec::decode(const RawData& raw, CodecData& codec, SnortData&)
+bool I4LRawIpCodec::decode(const RawData& raw, CodecData& codec, DecodeData&)
 {
     if(raw.len < 2)
         return false;
diff --git a/src/codecs/root/cd_linux_sll.cc b/src/codecs/root/cd_linux_sll.cc
index 9245e8f27..db88376bc 100644
--- a/src/codecs/root/cd_linux_sll.cc
+++ b/src/codecs/root/cd_linux_sll.cc
@@ -45,7 +45,7 @@ public:
 
 
     virtual void get_data_link_type(std::vector<int>&);
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
 };
 
 } // namespace
@@ -58,7 +58,7 @@ void LinuxSllCodec::get_data_link_type(std::vector<int>&v)
 #endif
 }
 
-bool LinuxSllCodec::decode(const RawData& raw, CodecData& data, SnortData&)
+bool LinuxSllCodec::decode(const RawData& raw, CodecData& data, DecodeData&)
 {
     /* do a little validation */
     if(raw.len < linux_sll::SLL_HDR_LEN)
diff --git a/src/codecs/root/cd_null.cc b/src/codecs/root/cd_null.cc
index b5f97f145..61af81697 100644
--- a/src/codecs/root/cd_null.cc
+++ b/src/codecs/root/cd_null.cc
@@ -45,7 +45,7 @@ public:
     ~NullCodec() {};
 
 
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
     virtual void get_data_link_type(std::vector<int>&);
 
 };
@@ -68,7 +68,7 @@ static const uint16_t NULL_HDRLEN = 4;
  *
  * Returns: void function
  */
-bool NullCodec::decode(const RawData& raw, CodecData& data, SnortData&)
+bool NullCodec::decode(const RawData& raw, CodecData& data, DecodeData&)
 {
     /* do a little validation */
     if(raw.len < NULL_HDRLEN)
diff --git a/src/codecs/root/cd_ppp.cc b/src/codecs/root/cd_ppp.cc
index 93cb27cdf..628938839 100644
--- a/src/codecs/root/cd_ppp.cc
+++ b/src/codecs/root/cd_ppp.cc
@@ -43,7 +43,7 @@ public:
     ~PPPCodec() {}
 
 
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
     virtual void get_data_link_type(std::vector<int>&);
 };
 
@@ -63,7 +63,7 @@ void PPPCodec::get_data_link_type(std::vector<int>& v)
 }
 
 
-bool PPPCodec::decode(const RawData& raw, CodecData& codec, SnortData&)
+bool PPPCodec::decode(const RawData& raw, CodecData& codec, DecodeData&)
 {
     if(raw.len < 2)
         return false;
diff --git a/src/codecs/root/cd_raw4.cc b/src/codecs/root/cd_raw4.cc
index 490e64edc..67664c37a 100644
--- a/src/codecs/root/cd_raw4.cc
+++ b/src/codecs/root/cd_raw4.cc
@@ -42,7 +42,7 @@ public:
     ~Raw4Codec() {};
 
 
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
     virtual void get_data_link_type(std::vector<int>&);
 
 };
@@ -69,7 +69,7 @@ public:
  *
  * Returns: void function
  */
-bool Raw4Codec::decode(const RawData&, CodecData& data, SnortData&)
+bool Raw4Codec::decode(const RawData&, CodecData& data, DecodeData&)
 {
     data.next_prot_id = ETHERTYPE_IPV4;
     return true;
diff --git a/src/codecs/root/cd_raw6.cc b/src/codecs/root/cd_raw6.cc
index 44ca0f732..3f0531212 100644
--- a/src/codecs/root/cd_raw6.cc
+++ b/src/codecs/root/cd_raw6.cc
@@ -41,7 +41,7 @@ public:
     Raw6Codec() : Codec(CD_RAW6_NAME){};
     ~Raw6Codec() {};
 
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
     virtual void get_data_link_type(std::vector<int>&);
 
 };
@@ -51,7 +51,7 @@ public:
 
 
 // raw packets are predetermined to be ip4 (above) or ip6 (below) by the DLT
-bool Raw6Codec::decode(const RawData&, CodecData& data, SnortData&)
+bool Raw6Codec::decode(const RawData&, CodecData& data, DecodeData&)
 {
     data.next_prot_id = ETHERTYPE_IPV6;
     return true;
diff --git a/src/codecs/root/cd_slip.cc b/src/codecs/root/cd_slip.cc
index b7f5117d1..ef39a1f90 100644
--- a/src/codecs/root/cd_slip.cc
+++ b/src/codecs/root/cd_slip.cc
@@ -40,7 +40,7 @@ public:
     SlipCodec() : Codec(CD_SLIP_NAME){};
     ~SlipCodec() {};
 
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
     virtual void get_data_link_type(std::vector<int>&);
 };
 
@@ -55,7 +55,7 @@ void SlipCodec::get_data_link_type(std::vector<int>& v)
 }
 
 
-bool SlipCodec::decode(const RawData& raw, CodecData& codec, SnortData&)
+bool SlipCodec::decode(const RawData& raw, CodecData& codec, DecodeData&)
 {
     if (raw.len < SLIP_HEADER_LEN)
         return false;
diff --git a/src/codecs/root/cd_wlan.cc b/src/codecs/root/cd_wlan.cc
index 008bdb8eb..272ef8171 100644
--- a/src/codecs/root/cd_wlan.cc
+++ b/src/codecs/root/cd_wlan.cc
@@ -64,7 +64,7 @@ public:
     ~WlanCodec() {};
 
 
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
     virtual void get_data_link_type(std::vector<int>&);
     virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/,
                     const Packet* const);
@@ -83,7 +83,7 @@ void WlanCodec::get_data_link_type(std::vector<int>&v)
 #endif
 }
 
-bool WlanCodec::decode(const RawData& raw, CodecData& codec, SnortData&)
+bool WlanCodec::decode(const RawData& raw, CodecData& codec, DecodeData&)
 {
     /* do a little validation */
     if(raw.len < MINIMAL_IEEE80211_HEADER_LEN)
diff --git a/src/codecs/template.cc b/src/codecs/template.cc
index 0fb26ff43..fd144f12d 100644
--- a/src/codecs/template.cc
+++ b/src/codecs/template.cc
@@ -115,7 +115,7 @@ public:
 
 
     // decode(...) must be implemented!!
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
 
     virtual void log(TextLog*, const uint8_t* /*raw_pkt*/, const Packet* const);
     virtual void get_protocol_ids(std::vector<uint16_t>&);
@@ -150,7 +150,7 @@ void NameCodec::get_protocol_ids(std::vector<uint16_t>&/*v*/)
 //    v.push_back(ETHERTYPE);
 }
 
-bool NameCodec::decode(const RawData& raw, CodecData& data, SnortData&)
+bool NameCodec::decode(const RawData& raw, CodecData& data, DecodeData&)
 {
     // reinterpret the raw data into this codec's data format
     const NameHdr* const hdr =
diff --git a/src/detection/fpdetect.cc b/src/detection/fpdetect.cc
index 5bd1c333c..a3e3da79e 100644
--- a/src/detection/fpdetect.cc
+++ b/src/detection/fpdetect.cc
@@ -75,6 +75,10 @@
 #include "managers/action_manager.h"
 #include "sfip/sf_ip.h"
 
+#include "protocols/tcp.h"
+#include "protocols/udp.h"
+#include "protocols/icmp4.h"
+
 /*
 **  Static function prototypes
 */
diff --git a/src/flow/flow_control.cc b/src/flow/flow_control.cc
index 1efb0ab55..3adbb0b5a 100644
--- a/src/flow/flow_control.cc
+++ b/src/flow/flow_control.cc
@@ -38,6 +38,10 @@
 #include "protocols/vlan.h"
 #include "managers/inspector_manager.h"
 #include "sfip/sf_ip.h"
+#include "protocols/tcp.h"
+#include "protocols/udp.h"
+#include "protocols/icmp4.h"
+#include "protocols/icmp6.h"
 
 FlowControl::FlowControl()
 {
diff --git a/src/flow/flow_key.cc b/src/flow/flow_key.cc
index 184b4df17..e5ec3136f 100644
--- a/src/flow/flow_key.cc
+++ b/src/flow/flow_key.cc
@@ -29,6 +29,8 @@
 #include "snort.h"
 #include "utils/util.h"
 #include "sfip/sf_ip.h"
+#include "protocols/icmp4.h"
+#include "protocols/icmp6.h"
 
 //-------------------------------------------------------------------------
 // init foo
diff --git a/src/framework/codec.h b/src/framework/codec.h
index 126fcea19..bf8a8a7c3 100644
--- a/src/framework/codec.h
+++ b/src/framework/codec.h
@@ -32,6 +32,7 @@
 // unfortunately necessary due to use of Ipapi in struct
 #include "protocols/ip.h"
 #include "protocols/mpls.h"  // FIXIT-M remove MPLS from Convenience pointers
+#include "framework/decode_data.h"
 
 struct TextLog;
 struct Packet;
@@ -196,96 +197,6 @@ struct RawData
 };
 
 
-enum DecodeFlags : std::uint16_t
-{
-    /*
-     * DO NOT USE PKT_TYPE_* directly!! Use PktType enum and
-     *      access methods to get/set.
-     *
-     * Since there are so few Packet Types, I decided to save
-     * some bytes (these get zeroes for every packet), and use
-     * the three least signfignat bits of 'decode_flags' as
-     * the packet_type. Unless you are adding a new PktType,
-     * I highly suggest you ignore this section and use
-     * the SnortData::xxx_pkt_type() setter and getter methods.
-     */
-    PKT_TYPE_UNKNOWN = 0x00,
-    PKT_TYPE_IP = 0x01,
-    PKT_TYPE_TCP = 0x02,
-    PKT_TYPE_UDP = 0x03,
-    PKT_TYPE_ICMP = 0x04,
-    PKT_TYPE_ARP = 0x05,
-    PKT_TYPE_FREE1 = 0x06, /* If protocol is added, update enum class PktType below. */
-    PKT_TYPE_FREE2 = 0x07, /* If protocol is added, update enum class PktType below. */
-    PKT_TYPE_MASK = 0x07,
-
-    /* error flags */
-    DECODE_ERR_CKSUM_IP = 0x0008,
-    DECODE_ERR_CKSUM_TCP = 0x0010,
-    DECODE_ERR_CKSUM_UDP = 0x0020,
-    DECODE_ERR_CKSUM_ICMP = 0x0040,
-    DECODE_ERR_CKSUM_ANY = 0x0080,
-    DECODE_ERR_BAD_TTL = 0x0100,
-    DECODE_ERR_FLAGS = (DECODE_ERR_CKSUM_IP | DECODE_ERR_CKSUM_TCP |
-                        DECODE_ERR_CKSUM_UDP | DECODE_ERR_CKSUM_UDP |
-                        DECODE_ERR_CKSUM_ICMP | DECODE_ERR_CKSUM_ANY |
-                        DECODE_ERR_BAD_TTL),
-
-
-    DECODE_PKT_TRUST = 0x0200,    /* Tell Snort++ to whitelist this packet */
-    DECODE_FRAG = 0x0400,  /* flag to indicate a fragmented packet */
-    DECODE_MF = 0x0800,
-};
-
-/* NOTE: if A protocol is added, update DecodeFlags! */
-enum class PktType : std::uint8_t
-{
-    UNKNOWN = PKT_TYPE_UNKNOWN,
-    IP = PKT_TYPE_IP,
-    TCP = PKT_TYPE_TCP,
-    UDP = PKT_TYPE_UDP,
-    ICMP = PKT_TYPE_ICMP,
-    ARP = PKT_TYPE_ARP,
-};
-
-struct SnortData
-{
-    /*  Pointers which will be used by Snort++. (starting with uint16_t so tcph is 64 bytes from start*/
-
-    /*
-     * these four pounters are each referenced literally
-     * dozens if not hundreds of times.  NOTHING else should be added!!
-     */
-    const tcp::TCPHdr* tcph;
-    const udp::UDPHdr* udph;
-    const icmp::ICMPHdr* icmph;
-    uint16_t sp;            /* source port (TCP/UDP) */
-    uint16_t dp;            /* dest port (TCP/UDP) */
-    uint16_t decode_flags;  /* First bits (currently 3), which are masked using the constant
-                             * DECODE_PKT_TYPE_MASK defined above, are specifically
-                             * for the PktType. Everything else is fair game flag.
-                             *
-                             */
-    ip::IpApi ip_api;
-    mpls::MplsHdr mplsHdr;
-
-    inline void reset()
-    {
-        static_assert(PKT_TYPE_UNKNOWN == 0,
-            "The Packets 'type' gets resets to zero - "
-            "which means zero is unkown");
-        memset((char*)&tcph, '\0', offsetof(SnortData, ip_api));
-        ip_api.reset();
-    }
-
-    inline void set_pkt_type(PktType pkt_type)
-    { decode_flags = (decode_flags & ~PKT_TYPE_MASK) | static_cast<uint16_t>(pkt_type); }
-
-    inline PktType get_pkt_type() const
-    { return static_cast<PktType>(decode_flags & PKT_TYPE_MASK); }
-};
-
-
 struct CodecData
 {
     /* This section will get reset before every decode() function call */
@@ -315,26 +226,6 @@ struct CodecData
     { next_prot_id = init_prot; }
 };
 
-#define PROTO_BIT__NONE     0x0000
-#define PROTO_BIT__IP       0x0001
-#define PROTO_BIT__ARP      0x0002
-#define PROTO_BIT__TCP      0x0004
-#define PROTO_BIT__UDP      0x0008
-#define PROTO_BIT__ICMP     0x0010
-#define PROTO_BIT__TEREDO   0x0020
-#define PROTO_BIT__GTP      0x0040
-#define PROTO_BIT__MPLS     0x0080
-#define PROTO_BIT__VLAN     0x0100
-#define PROTO_BIT__ETH      0x0200
-#define PROTO_BIT__TCP_EMBED_ICMP  0x0400
-#define PROTO_BIT__UDP_EMBED_ICMP  0x0800
-#define PROTO_BIT__ICMP_EMBED_ICMP 0x1000
-#define PROTO_BIT__ICMP_EMBED (PROTO_BIT__TCP_EMBED_ICMP | PROTO_BIT__UDP_EMBED_ICMP | PROTO_BIT__ICMP_EMBED_ICMP)
-#define PROTO_BIT__IP6_EXT  0x2000
-#define PROTO_BIT__FREE     0x4000
-#define PROTO_BIT__OTHER    0x8000
-#define PROTO_BIT__ALL      0xffff
-
 
 
 
@@ -419,11 +310,11 @@ public:
      *                          data.lyr_len = MIN_IP_HEADER_LEN + 12;
      *                          data.invalid_bytes = 8    === 20 - 12
      *
-     *      SnortData& = Data which will be sent to the rest of Snort++.
+     *      DecodeData& = Data which will be sent to the rest of Snort++.
      *                      contains convenience pointers and information
      *                      about this packet.
      **/
-    virtual bool decode(const RawData&, CodecData&, SnortData&)=0;
+    virtual bool decode(const RawData&, CodecData&, DecodeData&)=0;
 
     /*
      *  Log this layer's information
diff --git a/src/ips_options/ips_ack.cc b/src/ips_options/ips_ack.cc
index 8a1f90537..dcdac7644 100644
--- a/src/ips_options/ips_ack.cc
+++ b/src/ips_options/ips_ack.cc
@@ -41,6 +41,7 @@
 #include "framework/parameter.h"
 #include "framework/module.h"
 #include "framework/range.h"
+#include "protocols/tcp.h"
 
 static const char* s_name = "ack";
 
diff --git a/src/ips_options/ips_flags.cc b/src/ips_options/ips_flags.cc
index 97a448dc1..5400b49b4 100644
--- a/src/ips_options/ips_flags.cc
+++ b/src/ips_options/ips_flags.cc
@@ -42,6 +42,7 @@
 #include "framework/ips_option.h"
 #include "framework/parameter.h"
 #include "framework/module.h"
+#include "protocols/tcp.h"
 
 #define M_NORMAL  0
 #define M_ALL     1
diff --git a/src/ips_options/ips_icmp_id.cc b/src/ips_options/ips_icmp_id.cc
index b45110b38..155ea75f6 100644
--- a/src/ips_options/ips_icmp_id.cc
+++ b/src/ips_options/ips_icmp_id.cc
@@ -58,6 +58,8 @@
 #include "framework/parameter.h"
 #include "framework/module.h"
 #include "framework/range.h"
+#include "protocols/icmp4.h"
+#include "protocols/icmp6.h"
 
 static const char* s_name = "icmp_id";
 
diff --git a/src/ips_options/ips_icmp_seq.cc b/src/ips_options/ips_icmp_seq.cc
index 8e7018702..4c86b773b 100644
--- a/src/ips_options/ips_icmp_seq.cc
+++ b/src/ips_options/ips_icmp_seq.cc
@@ -58,6 +58,8 @@
 #include "framework/parameter.h"
 #include "framework/module.h"
 #include "framework/range.h"
+#include "protocols/icmp4.h"
+#include "protocols/icmp6.h"
 
 static const char* s_name = "icmp_seq";
 
diff --git a/src/ips_options/ips_icode.cc b/src/ips_options/ips_icode.cc
index a578e8c04..ca82959f5 100644
--- a/src/ips_options/ips_icode.cc
+++ b/src/ips_options/ips_icode.cc
@@ -38,6 +38,7 @@
 #include "framework/parameter.h"
 #include "framework/module.h"
 #include "framework/range.h"
+#include "protocols/icmp4.h"
 
 static const char* s_name = "icode";
 
diff --git a/src/ips_options/ips_itype.cc b/src/ips_options/ips_itype.cc
index 6f8f49db1..94fd99433 100644
--- a/src/ips_options/ips_itype.cc
+++ b/src/ips_options/ips_itype.cc
@@ -34,6 +34,7 @@
 #include "framework/parameter.h"
 #include "framework/module.h"
 #include "framework/range.h"
+#include "protocols/icmp4.h"
 
 static const char* s_name = "itype";
 
diff --git a/src/ips_options/ips_seq.cc b/src/ips_options/ips_seq.cc
index fbfb8899b..b0edb4f70 100644
--- a/src/ips_options/ips_seq.cc
+++ b/src/ips_options/ips_seq.cc
@@ -33,6 +33,7 @@
 #include "framework/parameter.h"
 #include "framework/module.h"
 #include "framework/range.h"
+#include "protocols/tcp.h"
 
 static const char* s_name = "seq";
 
diff --git a/src/ips_options/ips_window.cc b/src/ips_options/ips_window.cc
index 4d3ecbc8d..ade4654f8 100644
--- a/src/ips_options/ips_window.cc
+++ b/src/ips_options/ips_window.cc
@@ -33,6 +33,7 @@
 #include "framework/parameter.h"
 #include "framework/module.h"
 #include "framework/range.h"
+#include "protocols/tcp.h"
 
 static const char* s_name = "window";
 
diff --git a/src/loggers/alert_csv.cc b/src/loggers/alert_csv.cc
index 82329891d..e8135d20f 100644
--- a/src/loggers/alert_csv.cc
+++ b/src/loggers/alert_csv.cc
@@ -41,6 +41,11 @@
 #include "snort.h"
 #include "log/text_log.h"
 #include "log/log_text.h"
+#include "protocols/tcp.h"
+#include "protocols/udp.h"
+#include "protocols/icmp4.h"
+#include "protocols/icmp6.h"
+#include "protocols/eth.h"
 
 #define LOG_BUFFER (4*K_BYTES)
 
diff --git a/src/loggers/unified2.cc b/src/loggers/unified2.cc
index 951631aaa..9f1f4ecbd 100644
--- a/src/loggers/unified2.cc
+++ b/src/loggers/unified2.cc
@@ -64,6 +64,7 @@
 #include "stream/stream_api.h"
 #include "protocols/layer.h"
 #include "protocols/vlan.h"
+#include "protocols/icmp4.h"
 
 using namespace std;
 
diff --git a/src/network_inspectors/arp_spoof/arp_spoof.cc b/src/network_inspectors/arp_spoof/arp_spoof.cc
index ec1368985..db1946146 100644
--- a/src/network_inspectors/arp_spoof/arp_spoof.cc
+++ b/src/network_inspectors/arp_spoof/arp_spoof.cc
@@ -94,6 +94,7 @@
 #include "protocols/layer.h"
 #include "protocols/arp.h"
 #include "sfip/sf_ip.h"
+#include "protocols/eth.h"
 
 static const uint8_t bcast[6] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
 
diff --git a/src/network_inspectors/normalize/norm.cc b/src/network_inspectors/normalize/norm.cc
index 44f5efb3d..4df453938 100644
--- a/src/network_inspectors/normalize/norm.cc
+++ b/src/network_inspectors/normalize/norm.cc
@@ -35,6 +35,8 @@
 #include "protocols/ipv4_options.h"
 #include "protocols/tcp.h"
 #include "protocols/tcp_options.h"
+#include "protocols/icmp4.h"
+#include "protocols/icmp6.h"
 #include "stream/stream.h"
 
 typedef enum {
diff --git a/src/network_inspectors/perf_monitor/perf_base.cc b/src/network_inspectors/perf_monitor/perf_base.cc
index f46406734..6ba33d2bd 100644
--- a/src/network_inspectors/perf_monitor/perf_base.cc
+++ b/src/network_inspectors/perf_monitor/perf_base.cc
@@ -65,6 +65,7 @@
 #include "perf.h"
 #include "stream/stream_api.h"
 #include "utils/stats.h"
+#include "protocols/tcp.h"
 
 static void GetPktDropStats(SFBASE *, SFBASE_STATS *);
 static void DisplayBasePerfStatsConsole(SFBASE_STATS *, int);
diff --git a/src/network_inspectors/perf_monitor/perf_flow.cc b/src/network_inspectors/perf_monitor/perf_flow.cc
index 405514790..4dbde2de2 100644
--- a/src/network_inspectors/perf_monitor/perf_flow.cc
+++ b/src/network_inspectors/perf_monitor/perf_flow.cc
@@ -58,6 +58,7 @@
 #include "snort_types.h"
 #include "perf.h"
 #include "sfip/sf_ip.h"
+#include "protocols/icmp4.h"
 
 static void DisplayFlowStats(SFFLOW_STATS *sfFlowStats);
 static void WriteFlowStats(SFFLOW_STATS *, FILE *);
diff --git a/src/network_inspectors/port_scan/ps_detect.cc b/src/network_inspectors/port_scan/ps_detect.cc
index 0807fc5b8..052ecca66 100644
--- a/src/network_inspectors/port_scan/ps_detect.cc
+++ b/src/network_inspectors/port_scan/ps_detect.cc
@@ -116,6 +116,11 @@
 #include "ipobj.h"
 #include "stream/stream_api.h"
 #include "sfip/sf_ip.h"
+#include "protocols/tcp.h"
+#include "protocols/udp.h"
+#include "protocols/icmp4.h"
+#include "protocols/icmp6.h"
+#include "protocols/eth.h"
 
 typedef struct s_PS_HASH_KEY
 {
diff --git a/src/protocols/packet.h b/src/protocols/packet.h
index 244f3073a..822689619 100644
--- a/src/protocols/packet.h
+++ b/src/protocols/packet.h
@@ -47,19 +47,8 @@ extern "C" {
 }
 
 #include "main/snort_types.h"
-
-#include "framework/codec.h"
-#include "protocols/tcp.h"
-#include "protocols/udp.h"
-#include "protocols/eth.h"
-#include "protocols/icmp4.h"
-#include "protocols/icmp6.h"
-#include "protocols/mpls.h"
-#include "protocols/ip.h"
+#include "framework/decode_data.h"
 #include "protocols/layer.h"
-#include "protocols/ipv4.h"
-#include "protocols/ipv6.h"
-
 
 /*  D E F I N E S  ************************************************************/
 
@@ -176,7 +165,7 @@ struct SO_PUBLIC Packet
     const uint8_t* data;        /* packet payload pointer */
     uint16_t dsize;             /* packet payload size */
 
-    SnortData ptrs; // convenience pointers used throughout Snort++
+    DecodeData ptrs; // convenience pointers used throughout Snort++
     Layer* layers;    /* decoded encapsulations */
 
 
@@ -257,7 +246,6 @@ struct SO_PUBLIC Packet
 #define PKT_ZERO_LEN offsetof(Packet, pkth)
 
 
-#define GET_PKT_SEQ(p) (ntohl(p->ptrs.tcph->th_seq))
 
 /* Macros to deal with sequence numbers - p810 TCP Illustrated vol 2 */
 #define SEQ_LT(a,b)  ((int)((a) - (b)) <  0)
diff --git a/src/protocols/packet_manager.cc b/src/protocols/packet_manager.cc
index ff965bbaa..7d6aeed30 100644
--- a/src/protocols/packet_manager.cc
+++ b/src/protocols/packet_manager.cc
@@ -34,6 +34,8 @@
 #include "protocols/packet.h"
 #include "protocols/protocol_ids.h"
 #include "protocols/eth.h"
+#include "protocols/icmp4.h"
+#include "protocols/icmp6.h"
 #include "time/profiler.h"
 #include "parser/parser.h"
 
@@ -161,7 +163,7 @@ void PacketManager::decode(
     Packet* p, const DAQ_PktHdr_t* pkthdr, const uint8_t* pkt)
 {
     PROFILE_VARS;
-    SnortData unsure_encap_ptrs;
+    DecodeData unsure_encap_ptrs;
     uint16_t prev_prot_id = FINISHED_DECODE;
     uint8_t mapped_prot = CodecManager::grinder;
 
diff --git a/src/protocols/tcp.h b/src/protocols/tcp.h
index 8dd701f30..14ee82b42 100644
--- a/src/protocols/tcp.h
+++ b/src/protocols/tcp.h
@@ -60,6 +60,7 @@
 #define TCP_MAXSEG    0x02    /* set maximum segment size */
 #define SOL_TCP        6    /* TCP level */
 
+#define GET_PKT_SEQ(p) (ntohl(p->ptrs.tcph->th_seq))
 
 namespace tcp
 {
diff --git a/src/service_inspectors/ftp_telnet/ftp_data.cc b/src/service_inspectors/ftp_telnet/ftp_data.cc
index 4b6388507..b7addfb3b 100644
--- a/src/service_inspectors/ftp_telnet/ftp_data.cc
+++ b/src/service_inspectors/ftp_telnet/ftp_data.cc
@@ -50,6 +50,7 @@
 #include "framework/inspector.h"
 #include "framework/plug_data.h"
 #include "detection/detection_util.h"
+#include "protocols/tcp.h"
 
 static const char* s_name = "ftp_data";
 
diff --git a/src/service_inspectors/http_inspect/hi_main.cc b/src/service_inspectors/http_inspect/hi_main.cc
index 2aaf35bab..08b1afec4 100644
--- a/src/service_inspectors/http_inspect/hi_main.cc
+++ b/src/service_inspectors/http_inspect/hi_main.cc
@@ -80,6 +80,7 @@
 #include "loggers/unified2_common.h"
 #include "file_api/file_api.h"
 #include "sf_email_attach_decode.h"
+#include "protocols/tcp.h"
 
 const HiSearchToken hi_patterns[] =
 {
diff --git a/src/service_inspectors/http_inspect/hi_server.cc b/src/service_inspectors/http_inspect/hi_server.cc
index 0186a082b..ee5dd59c3 100644
--- a/src/service_inspectors/http_inspect/hi_server.cc
+++ b/src/service_inspectors/http_inspect/hi_server.cc
@@ -55,6 +55,7 @@ static THREAD_LOCAL uint8_t dechunk_buffer[65535];
 #include "snort_bounds.h"
 #include "detection_util.h"
 #include "utils/util_unfold.h"
+#include "protocols/tcp.h"
 
 #define STAT_END 100
 #define HTTPRESP_HEADER_NAME__COOKIE "Set-Cookie"
diff --git a/src/service_inspectors/rpc_decode/rpc_decode.cc b/src/service_inspectors/rpc_decode/rpc_decode.cc
index d6bb620be..2148d22b4 100644
--- a/src/service_inspectors/rpc_decode/rpc_decode.cc
+++ b/src/service_inspectors/rpc_decode/rpc_decode.cc
@@ -62,6 +62,7 @@
 #include "stream/stream_api.h"
 #include "stream/stream_splitter.h"
 #include "target_based/sftarget_protocol_reference.h"
+#include "protocols/tcp.h"
 
 #define RPC_MAX_BUF_SIZE   256
 #define RPC_FRAG_HDR_SIZE  sizeof(uint32_t)
diff --git a/src/stream/icmp/icmp_session.cc b/src/stream/icmp/icmp_session.cc
index af4f3ca5d..56d88821d 100644
--- a/src/stream/icmp/icmp_session.cc
+++ b/src/stream/icmp/icmp_session.cc
@@ -44,6 +44,8 @@
 #include "protocols/vlan.h"
 #include "protocols/ip.h"
 #include "protocols/icmp4.h"
+#include "protocols/udp.h"
+#include "protocols/tcp.h"
 #include "sfip/sf_ip.h"
 
 THREAD_LOCAL SessionStats icmpStats;
diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc
index bc6fc84ea..b3bd84ee0 100644
--- a/src/stream/tcp/tcp_session.cc
+++ b/src/stream/tcp/tcp_session.cc
@@ -83,6 +83,8 @@
 #include "tcp_module.h"
 #include "stream/stream_splitter.h"
 #include "sfip/sf_ip.h"
+#include "protocols/tcp.h"
+#include "protocols/eth.h"
 
 using namespace tcp;