From: Victor Julien Date: Thu, 27 Jun 2019 13:14:26 +0000 (+0200) Subject: tests: icmp over vxlan test X-Git-Tag: suricata-6.0.4~420 X-Git-Url: http://git.ipfire.org/gitweb/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F82%2Fhead;p=thirdparty%2Fsuricata-verify.git tests: icmp over vxlan test --- diff --git a/tests/vxlan-decoder-02/README.md b/tests/vxlan-decoder-02/README.md new file mode 100644 index 000000000..342ca79ab --- /dev/null +++ b/tests/vxlan-decoder-02/README.md @@ -0,0 +1,7 @@ +# Description + +Test basic VXLAN decoding + +# PCAP + +https://github.com/the-tcpdump-group/tcpdump/blob/master/tests/vxlan.pcap diff --git a/tests/vxlan-decoder-02/test.yaml b/tests/vxlan-decoder-02/test.yaml new file mode 100644 index 000000000..eb0e7e61c --- /dev/null +++ b/tests/vxlan-decoder-02/test.yaml @@ -0,0 +1,23 @@ +requires: + min-version: 5.0.0 + features: + - HAVE_LIBJANSSON + +checks: + - filter: + count: 1 + match: + event_type: flow + proto: "ICMP" + flow.pkts_toserver: 4 + flow.pkts_toclient: 4 + - filter: + count: 4 + match: + event_type: flow + dest_port: 4789 + - filter: + count: 4 + match: + event_type: alert + tunnel.dest_port: 4789 diff --git a/tests/vxlan-decoder-02/vxlan.pcap b/tests/vxlan-decoder-02/vxlan.pcap new file mode 100644 index 000000000..04f0c2f90 Binary files /dev/null and b/tests/vxlan-decoder-02/vxlan.pcap differ