Skip to content

Commit

Permalink
README/help: add info on IPS mode tests creation
Browse files Browse the repository at this point in the history
It is possible to create a test that runs in IPS mode by just adding ips
to its name. But that is not documented.

Task #7039
  • Loading branch information
jufajardini committed Jul 3, 2024
1 parent 381dcc7 commit c7ff55c
Show file tree
Hide file tree
Showing 2 changed files with 16 additions and 1 deletion.
15 changes: 15 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,10 @@ Or to run a single test:

- Create a directory that is the name of the new test.

If you want a test to run in IPS mode, add `ips` to the test name
this will make `--simulate-ips` command-line argument be passed when
the test is run.

- Copy a single pcap file into the test directory. It must end in
".pcap".

Expand Down Expand Up @@ -200,6 +204,8 @@ directory.
positional arguments:
<test-name> Name of the test folder
Add `ips` to the test name if you want it to run in IPS mode
the test is run.
<pcap-file> Path to the PCAP file
optional arguments:
Expand Down Expand Up @@ -252,6 +258,15 @@ newer:
--rules ../suricata-verify/tests/no-payload-output/test.rules test-02 input.pcap
```

#### Example 3

Create a Suricata-verify test named ``ips-drop-rule`` that will run over a pcap file
called ``input.pcap``, match its traffic against the rules in the ``ips-test.rules``
file and will have Suricata run the test in IPS mode:
```
../suricata-verify/createst.py --rules ../Documents/ips-test.rules ips-drop-rule input.pcap
```

#### Add Required Features

```
Expand Down
2 changes: 1 addition & 1 deletion createst.py
Original file line number Diff line number Diff line change
Expand Up @@ -370,7 +370,7 @@ def parse_args():
description="Create tests with a given PCAP. Execute the script"
" from a valid Suricata source directory.")
parser.add_argument("test-name", metavar="<test-name>",
help="Name of the test folder")
help="Name of the test folder. Add `ips` to the test name if you want it to run in IPS mode.")
parser.add_argument("pcap", metavar="<pcap-file>",
help="Path to the PCAP file")
parser.add_argument("--rules", metavar="<rules>",
Expand Down

0 comments on commit c7ff55c

Please sign in to comment.