diff --git a/tests/ftp-max-tx-rule/README.md b/tests/ftp-max-tx-rule/README.md new file mode 100644 index 000000000..d94414a25 --- /dev/null +++ b/tests/ftp-max-tx-rule/README.md @@ -0,0 +1,6 @@ +# Test Purpose + +Test if rule triggers, when seeing to many ftp txs + +# Pcap +generated with scapy diff --git a/tests/ftp-max-tx-rule/ftp.pcap b/tests/ftp-max-tx-rule/ftp.pcap new file mode 100644 index 000000000..a72dc3f42 Binary files /dev/null and b/tests/ftp-max-tx-rule/ftp.pcap differ diff --git a/tests/ftp-max-tx-rule/suricata.yaml b/tests/ftp-max-tx-rule/suricata.yaml new file mode 100644 index 000000000..06a1c26f3 --- /dev/null +++ b/tests/ftp-max-tx-rule/suricata.yaml @@ -0,0 +1,6 @@ +%YAML 1.1 +--- + +app-layer: + ftp: + max-tx: 2 diff --git a/tests/ftp-max-tx-rule/test.rules b/tests/ftp-max-tx-rule/test.rules new file mode 100644 index 000000000..74f3b7738 --- /dev/null +++ b/tests/ftp-max-tx-rule/test.rules @@ -0,0 +1 @@ +alert ftp any any -> any any (msg:"SURICATA FTP too many transactions"; app-layer-event:ftp.too_many_transactions; classtype:protocol-command-decode; sid:1;) diff --git a/tests/ftp-max-tx-rule/test.yaml b/tests/ftp-max-tx-rule/test.yaml new file mode 100644 index 000000000..0a8f792f8 --- /dev/null +++ b/tests/ftp-max-tx-rule/test.yaml @@ -0,0 +1,12 @@ +requires: + min-version: 9 + +args: + - -k none + +checks: + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1