diff --git a/tests/mqtt-frames/README.md b/tests/mqtt-frames/README.md new file mode 100644 index 000000000..fe06819ac --- /dev/null +++ b/tests/mqtt-frames/README.md @@ -0,0 +1,10 @@ +Description +=========== +Test MQTT frames. + +PCAP +==== + +Redmine ticket +============== +https://redmine.openinfosecfoundation.org/issues/5731 \ No newline at end of file diff --git a/tests/mqtt-frames/input.pcap b/tests/mqtt-frames/input.pcap new file mode 100644 index 000000000..9b4ec516b Binary files /dev/null and b/tests/mqtt-frames/input.pcap differ diff --git a/tests/mqtt-frames/test.rules b/tests/mqtt-frames/test.rules new file mode 100644 index 000000000..6155b0e05 --- /dev/null +++ b/tests/mqtt-frames/test.rules @@ -0,0 +1,2 @@ +alert mqtt any any -> any any (msg:"mqtt Frame 3"; frame:header; content:"|10|"; sid:1;) +alert mqtt any any -> any any (msg:"mqtt Frame 4"; frame:pdu; content:"|10|"; sid:2;) \ No newline at end of file diff --git a/tests/mqtt-frames/test.yaml b/tests/mqtt-frames/test.yaml new file mode 100644 index 000000000..127105044 --- /dev/null +++ b/tests/mqtt-frames/test.yaml @@ -0,0 +1,12 @@ +requires: + min-version: 7 + +checks: +- filter: + count: 1 + match: + alert.signature_id: 1 +- filter: + count: 1 + match: + alert.signature_id: 2 \ No newline at end of file