From 54a3a18a9e0af5e08cbe012ee23d6225dd6ae9cd Mon Sep 17 00:00:00 2001
From: Philippe Antoine <pantoine@oisf.net>
Date: Wed, 21 May 2025 14:48:15 +0200
Subject: [PATCH] snmp: probing parser returns unknown if not enough data

Ticket: 7019
---
 rust/src/snmp/snmp.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rust/src/snmp/snmp.rs b/rust/src/snmp/snmp.rs
index 2db8644b78..517d8f4b4a 100644
--- a/rust/src/snmp/snmp.rs
+++ b/rust/src/snmp/snmp.rs
@@ -361,7 +361,7 @@ unsafe extern "C" fn snmp_probing_parser(_flow: *const Flow,
     }
     let slice = build_slice!(input,input_len as usize);
     let alproto = ALPROTO_SNMP;
-    if slice.len() < 4 { return ALPROTO_FAILED; }
+    if slice.len() < 4 { return ALPROTO_UNKNOWN; }
     match parse_pdu_envelope_version(slice) {
         Ok((_,_))               => alproto,
         Err(Err::Incomplete(_)) => ALPROTO_UNKNOWN,
-- 
2.47.2