diff -ru snort-orig/src/preprocessors/HttpInspect/utils/hi_paf.c snort-new/src/preprocessors/HttpInspect/utils/hi_paf.c
--- snort-orig/src/preprocessors/HttpInspect/utils/hi_paf.c	2013-12-31 08:07:55.000000000 -0800
+++ snort-new/src/preprocessors/HttpInspect/utils/hi_paf.c	2014-02-19 14:38:10.000000000 -0800
@@ -750,7 +750,7 @@
 
     if ( nreq == MAX_PIPELINE )
     {
-        if ( stream_api->is_paf_active(ssn, 0) )
+        if ( stream_api->is_paf_active(ssn, true) ) // client-to-server direction
             hi_paf_event_pipe();
     }
     else if ( nreq < MAX_PIPELINE )
@@ -769,7 +769,7 @@
     Hi5State* s_req;
     uint32_t nreq, pipe;
 
-    void** pv = stream_api->get_paf_user_data(ssn, 1);
+    void** pv = stream_api->get_paf_user_data(ssn, true); // client-to-server direction
 
     if ( !*pv )
         return;
@@ -1157,7 +1157,7 @@
 {
     if ( ssn )
     {
-        Hi5State** s = (Hi5State **)stream_api->get_paf_user_data(ssn, 1);
+        Hi5State** s = (Hi5State **)stream_api->get_paf_user_data(ssn, true); // client-to-server direction
 
         if ( s && *s )
             return ( (*s)->flags & HIF_V09 );
diff -ru snort-orig/src/preprocessors/Stream5/snort_stream5_tcp.c snort-new/src/preprocessors/Stream5/snort_stream5_tcp.c
--- snort-orig/src/preprocessors/Stream5/snort_stream5_tcp.c	2013-12-31 08:07:55.000000000 -0800
+++ snort-new/src/preprocessors/Stream5/snort_stream5_tcp.c	2014-02-19 14:38:10.000000000 -0800
@@ -358,8 +358,22 @@
 typedef struct _StreamTracker
 {
     StateMgr  s_mgr;        /* state tracking goodies */
-    FlushMgr  flush_mgr;    /* please flush twice, it's a long way to
-                             * the bitbucket... */
+    FlushMgr  flush_mgr;    /* Tracks acks for packets in the reverse
+                             * direction.  That is, if the StreamTracker tracks
+                             * packets going from the client to the server
+                             * (c2s), then those packets will include the
+                             * client's acks for server-to-client (s2c)
+                             * packets.  Thus, to flush client-to-server
+                             * packets, you need to use the FlushMgr inside the
+                             * server-to-client StreamTracker, and vice versa.
+                             *
+                             * In other words, if we want to flush the packets
+                             * that the server has received, then we need to
+                             * look in the client state, to see which packets
+                             * the server has acknowledged seeing.
+                             * 
+                             * (please flush twice, it's a long way to
+                             * the bitbucket...) */
 
     // this is intended to be private to s5_paf but is included
     // directly to avoid the need for allocation; do not directly
@@ -421,8 +435,8 @@
 
 typedef struct _TcpSession
 {
-    StreamTracker client;
-    StreamTracker server;
+    StreamTracker client;   /* represents the client; stores s2c packets */
+    StreamTracker server;   /* represents the server; stores c2s packets */
     Stream5LWSession *lwssn;
 
 #ifdef DEBUG
@@ -901,8 +915,8 @@
     if ( !tcpssn )
         return NULL;
 
-    return to_server ? &tcpssn->server.paf_state.user
-                     : &tcpssn->client.paf_state.user;
+    return to_server ? &tcpssn->server.paf_state.user   // data from c2s pkts
+                     : &tcpssn->client.paf_state.user;  // data from s2c pkts
 }
 
 bool Stream5IsPafActiveTcp (Stream5LWSession* lwssn, bool to_server)
@@ -918,7 +932,8 @@
     if ( !tcpssn )
         return false;
 
-    fm = to_server ? &tcpssn->server.flush_mgr : &tcpssn->client.flush_mgr;
+    fm = to_server ? &tcpssn->client.flush_mgr  // acks for c2s pkts (inside s2c pkts)
+                   : &tcpssn->server.flush_mgr; // acks for s2c pkts (inside c2s pkts)
 
     return ( (fm->flush_policy == STREAM_FLPOLICY_PROTOCOL)
 #ifdef NORMALIZER
@@ -943,13 +958,13 @@
 
     if ( to_server )
     {
-        trk = &tcpssn->server;
-        fm = &tcpssn->server.flush_mgr;
+        trk = &tcpssn->server;              // data from c2s pkts
+        fm = &tcpssn->client.flush_mgr;     // acks for c2s pkts (inside s2c pkts)
     }
     else
     {
-        trk = &tcpssn->client;
-        fm = &tcpssn->client.flush_mgr;
+        trk = &tcpssn->client;              // data from s2c pkts
+        fm = &tcpssn->server.flush_mgr;     // acks for s2c pkts (inside c2s pkts)
     }
 
     switch ( fm->flush_policy)
