From db5e5488a121d7e2c47486323b5edafbf0c46197 Mon Sep 17 00:00:00 2001 From: Shivani Bhardwaj Date: Fri, 23 Aug 2024 12:36:50 +0530 Subject: [PATCH] flow/pkt: add test for either dir --- tests/detect-flow-pkts-either/README.md | 13 ++++++++ tests/detect-flow-pkts-either/test.rules | 5 ++++ tests/detect-flow-pkts-either/test.yaml | 38 ++++++++++++++++++++++++ 3 files changed, 56 insertions(+) create mode 100644 tests/detect-flow-pkts-either/README.md create mode 100644 tests/detect-flow-pkts-either/test.rules create mode 100644 tests/detect-flow-pkts-either/test.yaml diff --git a/tests/detect-flow-pkts-either/README.md b/tests/detect-flow-pkts-either/README.md new file mode 100644 index 000000000..89bdf91cd --- /dev/null +++ b/tests/detect-flow-pkts-either/README.md @@ -0,0 +1,13 @@ +Test +==== + +Test `flow.pkts:either`.. and `flow.bytes:either`.. keywords + +PCAP +==== + +From existing s-v test. + +Related tickets +============== +https://redmine.openinfosecfoundation.org/issues/5646 diff --git a/tests/detect-flow-pkts-either/test.rules b/tests/detect-flow-pkts-either/test.rules new file mode 100644 index 000000000..95b63004a --- /dev/null +++ b/tests/detect-flow-pkts-either/test.rules @@ -0,0 +1,5 @@ +alert ip any any -> any any (msg:"Flow has more than 3000 bytes and 10 pkts in either direction";flow.pkts:either,=10;flow.bytes:either,>3000; sid:1;) +alert ip any any -> any any (msg:"Flow has 10 pkts in toserver direction";flow.pkts:toserver,=10;prefilter;sid:2;) +alert ip any any -> any any (msg:"Flow has 10 pkts in toclient direction";flow.pkts:toclient,=10;sid:3;) +alert ip any any -> any any (msg:"Flow has more than 3000 bytes in toserver direction";flow.bytes:toserver,>3000;sid:4;) +alert ip any any -> any any (msg:"Flow has more than 3000 bytes in toclient direction";flow.bytes:toclient,>3000; threshold: type backoff, track by_flow, count 2, multiplier 10; sid:5;) diff --git a/tests/detect-flow-pkts-either/test.yaml b/tests/detect-flow-pkts-either/test.yaml new file mode 100644 index 000000000..634b6a034 --- /dev/null +++ b/tests/detect-flow-pkts-either/test.yaml @@ -0,0 +1,38 @@ +requires: + min-version: 8 + +pcap: ../decode-teredo-01/input.pcap + +args: +- -k none + +checks: +- filter: + count: 3 + match: + event_type: alert + alert.signature_id: 1 + +- filter: + count: 3 + match: + event_type: alert + alert.signature_id: 2 + +- filter: + count: 1 + match: + event_type: alert + alert.signature_id: 3 + +- filter: + count: 0 + match: + event_type: alert + alert.signature_id: 4 + +- filter: + count: 2 + match: + event_type: alert + alert.signature_id: 5 -- 2.47.2