snmp: adds test for community keyword

as was done by unit test DetectSNMPCommunityTest

diff --git a/tests/snmp-community/README.md b/tests/snmp-community/README.md
new file mode 100644 (file)
index 0000000..764e6b6
--- /dev/null
+++ b/tests/snmp-community/README.md
@@ -0,0 +1,7 @@
+# Test Purpose
+
+Match on SNMP community keyword
+
+## PCAP
+
+This PCAP from snmp-v2c-get is reused, as was done in DetectSNMPCommunityTest for first packet

diff --git a/tests/snmp-community/test.rules b/tests/snmp-community/test.rules
new file mode 100644 (file)
index 0000000..fe402de
--- /dev/null
+++ b/tests/snmp-community/test.rules
@@ -0,0 +1,2 @@
+alert snmp any any -> any any (msg:"SNMP Test Rule"; snmp.community; content:"[R0_C@cti!]"; sid:1; rev:1;)
+alert snmp any any -> any any (msg:"SNMP Test Rule"; snmp.community; content:"private"; sid:2; rev:1;)

diff --git a/tests/snmp-community/test.yaml b/tests/snmp-community/test.yaml
new file mode 100644 (file)
index 0000000..c36f372
--- /dev/null
+++ b/tests/snmp-community/test.yaml
@@ -0,0 +1,14 @@
+pcap: ../snmp-v2c-get/SNMPv2c_get_requests.pcap
+
+checks:
+ - filter:
+     count: 8
+     match:
+       event_type: alert
+       alert.signature_id: 1
+
+ - filter:
+     count: 0
+     match:
+       event_type: alert
+       alert.signature_id: 2