Pull request #4939: appid: ignore arcserve so dcerpc protocol is used when syncing...

Merge in SNORT/snort3 from ~AAVILASE/snort3:arcserve_dcerpc_intrusion_fix to master

Squashed commit of the following:

commit f183fca9b4fff875c7ab8b75096340408b5db2a1
Author: Andres Avila <aavilase@cisco.com>
Date:   Mon Oct 13 20:37:56 2025 -0400

    appid: ignore arcserve so dcerpc protocol is used when syncing to flow service

diff --git a/src/network_inspectors/appid/appid_session.cc b/src/network_inspectors/appid/appid_session.cc
index d441dec1d7e426506036867a8a198aac022c30b0..2d0ed9f0dbf8717a0e58e948244d5934c61bbdc0 100644 (file)
--- a/src/network_inspectors/appid/appid_session.cc
+++ b/src/network_inspectors/appid/appid_session.cc
@@ -361,6 +361,8 @@ void AppIdSession::sync_with_snort_protocol_id(AppId newAppId, Packet* p, AppidC
     case APP_ID_FTPS:
     case APP_ID_FTPSDATA:
 
+    case APP_ID_ARCSERVE:
+
     // These all are variants of HTTPS
     case APP_ID_DDM_SSL:
     case APP_ID_MSFT_GC_SSL: