From 0e9d05b8e5c8d7b60e6bb93586aeeb46548b8435 Mon Sep 17 00:00:00 2001
From: Philippe Antoine <pantoine@oisf.net>
Date: Wed, 21 May 2025 14:48:15 +0200
Subject: [PATCH] snmp: probing parser returns unknown if not enough data

Ticket: 7019
(cherry picked from commit 54a3a18a9e0af5e08cbe012ee23d6225dd6ae9cd)
---
 rust/src/snmp/snmp.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rust/src/snmp/snmp.rs b/rust/src/snmp/snmp.rs
index 1ff5b3f54b..ede7cec844 100644
--- a/rust/src/snmp/snmp.rs
+++ b/rust/src/snmp/snmp.rs
@@ -362,7 +362,7 @@ pub unsafe extern "C" fn rs_snmp_probing_parser(_flow: *const Flow,
     }
     let slice = build_slice!(input,input_len as usize);
     let alproto = ALPROTO_SNMP;
-    if slice.len() < 4 { return ALPROTO_FAILED; }
+    if slice.len() < 4 { return ALPROTO_UNKNOWN; }
     match parse_pdu_envelope_version(slice) {
         Ok((_,_))               => alproto,
         Err(Err::Incomplete(_)) => ALPROTO_UNKNOWN,
-- 
2.47.2