OISF · catenacyber · Nov 27, 2023 · Nov 27, 2023
diff --git a/tests/community-id-ipv4/test.yaml b/tests/community-id-ipv4/test.yaml
@@ -9,7 +9,6 @@ checks:
       dest_ip: 172.217.14.206
       dest_port: 443
       event_type: tls
-      pcap_cnt: 7
       proto: TCP
       src_ip: 172.26.0.39
       src_port: 35958

diff --git a/tests/community-id-ipv6/test.yaml b/tests/community-id-ipv6/test.yaml
@@ -9,7 +9,6 @@ checks:
       dest_ip: 2607:f8b0:400a:0800:0000:0000:0000:200e
       dest_port: 443
       event_type: tls
-      pcap_cnt: 41
       proto: TCP
       src_ip: 2600:1f13:00f8:d400:03a6:303c:e011:18eb
       src_port: 60202
@@ -22,7 +21,6 @@ checks:
       dest_ip: 2001:4860:4860:0000:0000:0000:0000:8888
       dest_port: 443
       event_type: tls
-      pcap_cnt: 7
       proto: TCP
       src_ip: 2600:1f13:00f8:d400:03a6:303c:e011:18eb
       src_port: 33892

diff --git a/tests/ssh-newkeys/README.md b/tests/ssh-newkeys/README.md
@@ -0,0 +1,8 @@
+# Description
+
+Test rule on ssh for new keys packet.
+https://redmine.openinfosecfoundation.org/issues/6578
+
+# PCAP
+
+The pcap comes from https://forum.suricata.io/t/can-not-get-ssh-alert/4223/9
diff --git a/tests/ssh-newkeys/input.pcap b/tests/ssh-newkeys/input.pcap
diff --git a/tests/ssh-newkeys/test.rules b/tests/ssh-newkeys/test.rules
@@ -0,0 +1 @@
+alert ssh any any -> any 22 (msg:"This is a test"; content:"|15 00 00 00 00 00 00 00 00 00 00|"; classtype:protocol-command-decode; sid:1300013; rev:1; metadata:created_at 2023_05_23, updated_at 2023_05_24;)
diff --git a/tests/ssh-newkeys/test.yaml b/tests/ssh-newkeys/test.yaml
@@ -0,0 +1,9 @@
+args:
+ - -k none
+
+checks:
+  - filter:
+      count: 1
+      match:
+         event_type: alert
+         alert.signature_id: 1300013
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		alert ssh any any -> any 22 (msg:"This is a test"; content:"\|15 00 00 00 00 00 00 00 00 00 00\|"; classtype:protocol-command-decode; sid:1300013; rev:1; metadata:created_at 2023_05_23, updated_at 2023_05_24;)