From 211a16c16affb07a7255789485df02528f1aee73 Mon Sep 17 00:00:00 2001 From: "Andres Avila Segura (aavilase)" Date: Tue, 14 Oct 2025 21:21:05 +0000 Subject: [PATCH] Pull request #4939: appid: ignore arcserve so dcerpc protocol is used when syncing to flow service Merge in SNORT/snort3 from ~AAVILASE/snort3:arcserve_dcerpc_intrusion_fix to master Squashed commit of the following: commit f183fca9b4fff875c7ab8b75096340408b5db2a1 Author: Andres Avila Date: Mon Oct 13 20:37:56 2025 -0400 appid: ignore arcserve so dcerpc protocol is used when syncing to flow service --- src/network_inspectors/appid/appid_session.cc | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/network_inspectors/appid/appid_session.cc b/src/network_inspectors/appid/appid_session.cc index d441dec1d..2d0ed9f0d 100644 --- a/src/network_inspectors/appid/appid_session.cc +++ b/src/network_inspectors/appid/appid_session.cc @@ -361,6 +361,8 @@ void AppIdSession::sync_with_snort_protocol_id(AppId newAppId, Packet* p, AppidC case APP_ID_FTPS: case APP_ID_FTPSDATA: + case APP_ID_ARCSERVE: + // These all are variants of HTTPS case APP_ID_DDM_SSL: case APP_ID_MSFT_GC_SSL: -- 2.47.3