snmp: probing parser returns unknown if not enough data

Ticket: 7019

diff --git a/rust/src/snmp/snmp.rs b/rust/src/snmp/snmp.rs
index 2db8644b7849a9daca0a028aac5d238e888fc911..517d8f4b4ad8ba125aaba3d67bc9f8c17acfd1a2 100644 (file)
--- a/rust/src/snmp/snmp.rs
+++ b/rust/src/snmp/snmp.rs
@@ -361,7 +361,7 @@ unsafe extern "C" fn snmp_probing_parser(_flow: *const Flow,
     }
     let slice = build_slice!(input,input_len as usize);
     let alproto = ALPROTO_SNMP;
-    if slice.len() < 4 { return ALPROTO_FAILED; }
+    if slice.len() < 4 { return ALPROTO_UNKNOWN; }
     match parse_pdu_envelope_version(slice) {
         Ok((_,_))               => alproto,
         Err(Err::Incomplete(_)) => ALPROTO_UNKNOWN,