From: Andres Avila Segura (aavilase) Date: Tue, 14 Oct 2025 21:21:05 +0000 (+0000) Subject: Pull request #4939: appid: ignore arcserve so dcerpc protocol is used when syncing... X-Git-Tag: 3.9.7.0~20 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=211a16c16affb07a7255789485df02528f1aee73;p=thirdparty%2Fsnort3.git Pull request #4939: appid: ignore arcserve so dcerpc protocol is used when syncing to flow service Merge in SNORT/snort3 from ~AAVILASE/snort3:arcserve_dcerpc_intrusion_fix to master Squashed commit of the following: commit f183fca9b4fff875c7ab8b75096340408b5db2a1 Author: Andres Avila Date: Mon Oct 13 20:37:56 2025 -0400 appid: ignore arcserve so dcerpc protocol is used when syncing to flow service --- diff --git a/src/network_inspectors/appid/appid_session.cc b/src/network_inspectors/appid/appid_session.cc index d441dec1d..2d0ed9f0d 100644 --- a/src/network_inspectors/appid/appid_session.cc +++ b/src/network_inspectors/appid/appid_session.cc @@ -361,6 +361,8 @@ void AppIdSession::sync_with_snort_protocol_id(AppId newAppId, Packet* p, AppidC case APP_ID_FTPS: case APP_ID_FTPSDATA: + case APP_ID_ARCSERVE: + // These all are variants of HTTPS case APP_ID_DDM_SSL: case APP_ID_MSFT_GC_SSL: