diff --git a/tests/detect-flow-pkts-either/README.md b/tests/detect-flow-pkts-either/README.md new file mode 100644 index 000000000..89bdf91cd --- /dev/null +++ b/tests/detect-flow-pkts-either/README.md @@ -0,0 +1,13 @@ +Test +==== + +Test `flow.pkts:either`.. and `flow.bytes:either`.. keywords + +PCAP +==== + +From existing s-v test. + +Related tickets +============== +https://redmine.openinfosecfoundation.org/issues/5646 diff --git a/tests/detect-flow-pkts-either/test.rules b/tests/detect-flow-pkts-either/test.rules new file mode 100644 index 000000000..cfd5a5e03 --- /dev/null +++ b/tests/detect-flow-pkts-either/test.rules @@ -0,0 +1 @@ +alert ip any any -> any any (msg:"Flow has more than 3000 bytes and 10 pkts in either direction";flow.pkts:either,=10;flow.bytes:either,>3000; sid:1;) diff --git a/tests/detect-flow-pkts-either/test.yaml b/tests/detect-flow-pkts-either/test.yaml new file mode 100644 index 000000000..1905ae7d7 --- /dev/null +++ b/tests/detect-flow-pkts-either/test.yaml @@ -0,0 +1,14 @@ +requires: + min-version: 8 + +pcap: ../decode-teredo-01/input.pcap + +args: +- -k none + +checks: +- filter: + count: 3 + match: + event_type: alert + alert.signature_id: 1 diff --git a/tests/detect-flow-pkts/README.md b/tests/detect-flow-pkts/README.md index 6691a2c40..2d9c13602 100644 --- a/tests/detect-flow-pkts/README.md +++ b/tests/detect-flow-pkts/README.md @@ -1,7 +1,7 @@ Test ==== -Test `flow.pkts_toclient` and alike (bytes, server) keywords +Test `flow.pkts:toclient`.. and alike (bytes, server) keywords PCAP ==== diff --git a/tests/detect-flow-pkts/test.rules b/tests/detect-flow-pkts/test.rules index d808c07d9..a5d4a914a 100644 --- a/tests/detect-flow-pkts/test.rules +++ b/tests/detect-flow-pkts/test.rules @@ -1 +1 @@ -alert ip any any -> any any (msg:"Flow has 10 packets"; flow.pkts_toclient:10; flow.pkts_toserver:10; flow.bytes_toserver:<3000; flow.bytes_toclient:>8000; sid:1;) +alert ip any any -> any any (msg:"Flow has 10 packets"; flow.pkts:toclient,10; flow.pkts:toserver,=10; flow.bytes:toserver,<3000; flow.bytes:toclient,>8000; sid:1;)