Skip to content

tests: add igmp tests #2910

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
victorjulien merged 1 commit into from
Mar 2, 2026
Merged

tests: add igmp tests #2910

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions tests/igmp/igmp-v1-v2-rgmp-01/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Pcap from https://wiki.wireshark.org/IGMP
8 changes: 8 additions & 0 deletions tests/igmp/igmp-v1-v2-rgmp-01/test.rules
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
alert igmp any any -> 224.0.0.25 any (msg:"RGMP Hello"; igmp.hdr; content:"|ff|"; startswith; ttl:1; sid:1;)
alert igmp any any -> 224.0.0.25 any (msg:"RGMP Hello"; igmp.type:0xff; ttl:1; sid:2;)
alert igmp any any -> any any (msg:"IGMP with payload"; dsize:>0; sid:3;)
alert igmp any any -> any any (msg:"IGMP with ttl > 1"; ttl:>1; sid:4;)
alert igmp any any -> any any (msg:"IGMP with router alert"; ipopts:rtralt; sid:5;)
alert igmp any any -> any any (msg:"IGMP w/o router alert"; ipv4.hdr; content:!"|94 04 00 00|"; offset:20; sid:6;)
alert igmp any any -> any any (msg:"IGMP good csum"; igmp-csum:valid; sid:7;)
alert igmp any any -> any any (msg:"IGMP bad csum"; igmp-csum:invalid; sid:8;)
78 changes: 78 additions & 0 deletions tests/igmp/igmp-v1-v2-rgmp-01/test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,78 @@
requires:
min-version: 9

checks:
- filter:
count: 19
match:
event_type: alert
alert.signature_id: 1
proto: "IGMP"
rgmp.type: 255
- filter:
count: 19
match:
event_type: alert
alert.signature_id: 2
proto: "IGMP"
rgmp.type: 255
- filter:
count: 0
match:
event_type: alert
alert.signature_id: 3
- filter:
count: 0
match:
event_type: alert
alert.signature_id: 4
- filter:
count: 87
match:
event_type: alert
alert.signature_id: 5
proto: "IGMP"
- filter:
count: 60
match:
event_type: alert
alert.signature_id: 6
proto: "IGMP"
- filter:
count: 147
match:
event_type: alert
alert.signature_id: 7
proto: "IGMP"
- filter:
count: 19
match:
event_type: alert
alert.signature_id: 7
proto: "IGMP"
rgmp.type: 255
- filter:
count: 10
match:
event_type: alert
alert.signature_id: 7
proto: "IGMP"
igmp.version: 1
- filter:
count: 118
match:
event_type: alert
alert.signature_id: 7
proto: "IGMP"
igmp.version: 2
- filter:
count: 0
match:
event_type: alert
alert.signature_id: 8
proto: "IGMP"
- filter:
count: 1
match:
event_type: stats
stats.decoder.igmp: 147
Binary file added tests/igmp/igmp-v1-v2-rgmp-01/wireshark-wiki-IGMP-dataset.pcap
View file
Open in desktop
Binary file not shown.
4 changes: 4 additions & 0 deletions tests/igmp/igmp-v1-v2-rgmp-02-decoder-events/test.rules
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
# IGMP
alert igmp any any -> any any (msg:"SURICATA IGMP packet too small"; decode-event:igmp.pkt_too_small; classtype:protocol-command-decode; sid:2200127; rev:1;)
alert igmp any any -> any any (msg:"SURICATA IGMPv3 packet too small"; decode-event:igmp.v3_pkt_too_small; classtype:protocol-command-decode; sid:2200128; rev:1;)
alert igmp any any -> any any (msg:"SURICATA IGMP malformed packet"; decode-event:igmp.malformed; classtype:protocol-command-decode; sid:2200129; rev:1;)
29 changes: 29 additions & 0 deletions tests/igmp/igmp-v1-v2-rgmp-02-decoder-events/test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
requires:
min-version: 9

pcap: ../igmp-v1-v2-rgmp-01/wireshark-wiki-IGMP-dataset.pcap

checks:
- filter:
count: 0
match:
event_type: alert
alert.signature_id: 2200127
- filter:
count: 0
match:
event_type: alert
alert.signature_id: 2200128
- filter:
count: 0
match:
event_type: alert
alert.signature_id: 2200129
- filter:
count: 1
match:
event_type: stats
stats.decoder.igmp: 147
stats.decoder.event.igmp.pkt_too_small: 0
stats.decoder.event.igmp.v3_pkt_too_small: 0
stats.decoder.event.igmp.malformed: 0
1 change: 1 addition & 0 deletions tests/igmp/igmp-v3-queries-01/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Pcap from https://github.com/the-tcpdump-group/tcpdump/blob/master/tests/igmpv3-queries.pcap
Binary file added tests/igmp/igmp-v3-queries-01/tcpdump-gh-igmpv3-queries.pcap
View file
Open in desktop
Binary file not shown.
8 changes: 8 additions & 0 deletions tests/igmp/igmp-v3-queries-01/test.rules
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
alert igmp any any -> 224.0.0.25 any (msg:"RGMP Hello"; igmp.hdr; content:"|ff|"; startswith; ttl:1; sid:1;)
alert igmp any any -> 224.0.0.25 any (msg:"RGMP Hello"; igmp.type:0xff; ttl:1; sid:2;)
alert igmp any any -> any any (msg:"IGMP with payload"; dsize:>0; sid:3;)
alert igmp any any -> any any (msg:"IGMP with ttl > 1"; ttl:>1; sid:4;)
alert igmp any any -> any any (msg:"IGMP with router alert"; ipopts:rtralt; sid:5;)
alert igmp any any -> any any (msg:"IGMP w/o router alert"; ipv4.hdr; content:!"|94 04 00 00|"; offset:20; sid:6;)
alert igmp any any -> any any (msg:"IGMP good csum"; igmp-csum:valid; sid:7;)
alert igmp any any -> any any (msg:"IGMP bad csum"; igmp-csum:invalid; sid:8;)
64 changes: 64 additions & 0 deletions tests/igmp/igmp-v3-queries-01/test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,64 @@
requires:
min-version: 9

checks:
- filter:
count: 0
match:
event_type: alert
alert.signature_id: 1
proto: "IGMP"
rgmp.type: 255
- filter:
count: 0
match:
event_type: alert
alert.signature_id: 2
proto: "IGMP"
rgmp.type: 255
- filter:
count: 0
match:
event_type: alert
alert.signature_id: 3
- filter:
count: 0
match:
event_type: alert
alert.signature_id: 4
- filter:
count: 6
match:
event_type: alert
alert.signature_id: 5
proto: "IGMP"
- filter:
count: 0
match:
event_type: alert
alert.signature_id: 6
proto: "IGMP"
- filter:
count: 6
match:
event_type: alert
alert.signature_id: 7
proto: "IGMP"
- filter:
count: 6
match:
event_type: alert
alert.signature_id: 7
proto: "IGMP"
igmp.version: 3
- filter:
count: 0
match:
event_type: alert
alert.signature_id: 8
proto: "IGMP"
- filter:
count: 1
match:
event_type: stats
stats.decoder.igmp: 6
Loading