--- /dev/null
+requires:
+ min-version: 8
+
+pcap: ../../dns-tcp-www-google-com-v1/dns.pcap
+
+checks:
+ - filter:
+ count: 1
+ match:
+ src_ip: "10.16.1.11"
+ dest_ip: "8.8.4.4"
+ event_type: dns
+ dns.type: request
+ - filter:
+ count: 1
+ match:
+ src_ip: "10.16.1.11"
+ dest_ip: "8.8.4.4"
+ event_type: dns
+ dns.type: response
--- /dev/null
+A basic TCP DNS test that sends one request with a response that
+contains multiple answers.
--- /dev/null
+%YAML 1.1
+---
+
+# Remove stats logging.
+stats:
+ enabled: no
+
+outputs:
+ - eve-log:
+ enabled: yes
+ types:
+ - dns:
+ version: 2
-pcap: ../dns-tcp-www-google-com-v1/dns.pcap
-
-requires:
- features:
- - HAVE_LIBJANSSON
+pcap: ../../../dns-tcp-www-google-com-v1/dns.pcap
checks:
- filter: