tests: add simple ip only w/ negated content test

diff --git a/tests/like-ip-only-01/krb5-frag.pcap b/tests/like-ip-only-01/krb5-frag.pcap
new file mode 100644 (file)
index 0000000..209fd19
Binary files /dev/null and b/tests/like-ip-only-01/krb5-frag.pcap differ

diff --git a/tests/like-ip-only-01/suricata.yaml b/tests/like-ip-only-01/suricata.yaml
new file mode 100644 (file)
index 0000000..601b909
--- /dev/null
+++ b/tests/like-ip-only-01/suricata.yaml
@@ -0,0 +1,8 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      types:
+        - alert

diff --git a/tests/like-ip-only-01/test.rules b/tests/like-ip-only-01/test.rules
new file mode 100644 (file)
index 0000000..c81a6e7
--- /dev/null
+++ b/tests/like-ip-only-01/test.rules
@@ -0,0 +1 @@
+alert tcp 192.168.51.206 any -> !192.168.51.206 any (msg:"simple negated ip test"; flow:established; sid:1001;)

diff --git a/tests/like-ip-only-01/test.yaml b/tests/like-ip-only-01/test.yaml
new file mode 100644 (file)
index 0000000..0a8eb64
--- /dev/null
+++ b/tests/like-ip-only-01/test.yaml
@@ -0,0 +1,11 @@
+requires:
+  min-version: 7
+
+args:
+- -k none
+
+checks:
+  - filter:
+      count: 17
+      match:
+        event_type: alert