From: Victor Julien Date: Mon, 18 Jan 2021 17:01:54 +0000 (+0100) Subject: tests: add ERSPAN II test X-Git-Tag: suricata-6.0.4~175 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=de905c2410ad2d63ca33d7601c33e43a4e65efb8;p=thirdparty%2Fsuricata-verify.git tests: add ERSPAN II test --- diff --git a/tests/decode-erspan-typeII-01/README.md b/tests/decode-erspan-typeII-01/README.md new file mode 100644 index 000000000..463b816b4 --- /dev/null +++ b/tests/decode-erspan-typeII-01/README.md @@ -0,0 +1,4 @@ +PCAP +==== + +Pcap found here https://www.cloudshark.org/captures/76ce4261df29 diff --git a/tests/decode-erspan-typeII-01/input.pcap b/tests/decode-erspan-typeII-01/input.pcap new file mode 100644 index 000000000..100acd791 Binary files /dev/null and b/tests/decode-erspan-typeII-01/input.pcap differ diff --git a/tests/decode-erspan-typeII-01/test.rules b/tests/decode-erspan-typeII-01/test.rules new file mode 100644 index 000000000..5b34d4a9b --- /dev/null +++ b/tests/decode-erspan-typeII-01/test.rules @@ -0,0 +1,2 @@ +alert icmp any any -> any any (itype:0; sid:1;) +alert icmp any any -> any any (itype:8; prefilter; sid:2;) diff --git a/tests/decode-erspan-typeII-01/test.yaml b/tests/decode-erspan-typeII-01/test.yaml new file mode 100644 index 000000000..36eaf2df2 --- /dev/null +++ b/tests/decode-erspan-typeII-01/test.yaml @@ -0,0 +1,49 @@ +requires: + min-version: 6 + +args: +- -k none + +checks: +- filter: + count: 1 + match: + dest_ip: 23.0.0.3 + event_type: flow + flow.age: 0 + flow.alerted: true + flow.bytes_toclient: 244 + flow.bytes_toserver: 244 + flow.pkts_toclient: 2 + flow.pkts_toserver: 2 + flow.reason: shutdown + flow.state: established + icmp_code: 0 + icmp_type: 8 + proto: ICMP + response_icmp_code: 0 + response_icmp_type: 0 + src_ip: 23.0.0.2 + vlan[0]: 23 +- filter: + count: 2 + match: + dest_ip: 23.0.0.3 + event_type: alert + icmp_code: 0 + icmp_type: 8 + proto: ICMP + src_ip: 23.0.0.2 + vlan[0]: 23 + alert.signature_id: 2 +- filter: + count: 2 + match: + dest_ip: 23.0.0.2 + event_type: alert + icmp_code: 0 + icmp_type: 0 + proto: ICMP + src_ip: 23.0.0.3 + vlan[0]: 23 + alert.signature_id: 1