snmp: probing parser returns unknown if not enough data

Ticket: 7019
(cherry picked from commit 54a3a18a9e0af5e08cbe012ee23d6225dd6ae9cd)

diff --git a/rust/src/snmp/snmp.rs b/rust/src/snmp/snmp.rs
index 1ff5b3f54bdd81d5a1b93bfc29dc7ada3d0b3870..ede7cec84410442a8670ae3dfde45c9d423fa9c2 100644 (file)
--- a/rust/src/snmp/snmp.rs
+++ b/rust/src/snmp/snmp.rs
@@ -362,7 +362,7 @@ pub unsafe extern "C" fn rs_snmp_probing_parser(_flow: *const Flow,
     }
     let slice = build_slice!(input,input_len as usize);
     let alproto = ALPROTO_SNMP;
-    if slice.len() < 4 { return ALPROTO_FAILED; }
+    if slice.len() < 4 { return ALPROTO_UNKNOWN; }
     match parse_pdu_envelope_version(slice) {
         Ok((_,_))               => alproto,
         Err(Err::Incomplete(_)) => ALPROTO_UNKNOWN,