2 files changed, 7 insertions, 4 deletions
diff --git a/source3/modules/vfs_smb_traffic_analyzer.c b/source3/modules/vfs_smb_traffic_analyzer.c
index 6b41affb06..cf90960540 100644
--- a/source3/modules/vfs_smb_traffic_analyzer.c
+++ b/source3/modules/vfs_smb_traffic_analyzer.c
@@ -20,6 +20,7 @@
  */
 
 #include "includes.h"
+#include "../smbd/globals.h"
 #include "../lib/crypto/crypto.h"
 #include "vfs_smb_traffic_analyzer.h"
 #include "../libcli/security/security.h"
@@ -313,6 +314,7 @@ static char *smb_traffic_analyzer_create_string( TALLOC_CTX *ctx,
 	 * 4.affected share
 	 * 5.domain
 	 * 6.timestamp
+	 * 7.IP Addresss of client
 	 */
 
 	/*
@@ -348,10 +350,9 @@ static char *smb_traffic_analyzer_create_string( TALLOC_CTX *ctx,
 		tm->tm_sec, \
 		(int)seconds);
 	len = strlen( timestr );
-
 	/* create the string of common data */
 	buf = talloc_asprintf(ctx,
-		"%s%04u%s%04u%s%04u%s%04u%s%04u%s%04u%s",
+		"%s%04u%s%04u%s%04u%s%04u%s%04u%s%04u%s%04u%s",
 		common_data_count_str,
 		(unsigned int) strlen(vfs_operation_str),
 		vfs_operation_str,
@@ -365,7 +366,9 @@ static char *smb_traffic_analyzer_create_string( TALLOC_CTX *ctx,
 		strlen(handle->conn->server_info->info3->base.domain.string),
 		handle->conn->server_info->info3->base.domain.string,
 		(unsigned int) strlen(timestr),
-		timestr);
+		timestr,
+		(unsigned int) strlen(handle->conn->sconn->client_id.addr),
+		handle->conn->sconn->client_id.addr);
 
 	talloc_free(common_data_count_str);
 
diff --git a/source3/modules/vfs_smb_traffic_analyzer.h b/source3/modules/vfs_smb_traffic_analyzer.h
index 3f47ea5a72..bfc0614132 100644
--- a/source3/modules/vfs_smb_traffic_analyzer.h
+++ b/source3/modules/vfs_smb_traffic_analyzer.h
@@ -85,7 +85,7 @@
  * so that if the receiver is using an older version of the protocol
  * it knows which blocks it can ignore.
  */
-#define SMBTA_COMMON_DATA_COUNT "00016"
+#define SMBTA_COMMON_DATA_COUNT "00017"
 
 /*
  * VFS Functions identifier table. In protocol version 2, every vfs