Make SNAP analyzer use both OUI and protocol for forwarding

src/packet_analysis/protocol/snap/SNAP.cc

@@ -36,11 +36,11 @@ bool SNAPAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet
     data += 5;
     len -= 5;
 
-    if ( oui == 0 ) {
+    // Protocol values for SNAP can differ based what OUI publishes them, so use a
-        // If the OUI is zero, the protocol is a standard ethertype and can be
+    // combination of them for the identifier used to forward.
-        // forwarded as such.
+    int64_t identifier = oui;
-        return ForwardPacket(len, data, packet, protocol);
+    identifier <<= 16;
-    }
+    identifier |= protocol;
 
-    return true;
+    return ForwardPacket(len, data, packet, identifier);
 }

testing/btest/Baseline/scripts.base.protocols.snap.snap-cdp/unknown_protocols.log

@@ -0,0 +1,11 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+#separator \x09
+#set_separator	,
+#empty_field	(empty)
+#unset_field	-
+#path	unknown_protocols
+#open XXXX-XX-XX-XX-XX-XX
+#fields	ts	analyzer	protocol_id	first_bytes	analyzer_history
+#types	time	string	string	string	vector[string]
+XXXXXXXXXX.XXXXXX	SNAP	0xc2000	01b4dff0000100065231	ETHERNET,SNAP
+#close XXXX-XX-XX-XX-XX-XX

testing/btest/Traces/README

@@ -48,3 +48,5 @@ Trace Index/Sources:
   https://zeekorg.slack.com/archives/CSZBXF6TH/p1738261449655049
 - tunnels/geneve-tagged-udp-packet.pcap
   Provided by Eldon Koyle Corelight for testing.
+- cdp-v1.pcap
+  From the Wireshark library of captures at https://wiki.wireshark.org/samplecaptures.

testing/btest/scripts/base/protocols/snap/snap-cdp.test

@@ -0,0 +1,4 @@
+# @TEST-EXEC: zeek -r $TRACES/cdp-v1.pcap %INPUT
+# @TEST-EXEC: btest-diff unknown_protocols.log
+
+@load policy/misc/unknown-protocols