OISF · victorjulien · Jan 17, 2025 · Jan 14, 2025
diff --git a/tests/ldap-abandon/Makefile b/tests/ldap-abandon/Makefile
@@ -0,0 +1,3 @@
+ldap.pcap: ldap.syn
+	flowsynth.py -f pcap -w $@ $^
+
diff --git a/tests/ldap-abandon/README.md b/tests/ldap-abandon/README.md
@@ -0,0 +1,9 @@
+# Test Purpose
+
+Test that LDAP Abandon operation is parsed correctly.
+
+## PCAP
+
+This PCAP was generated with flowsynth using
+this documentation as a reference:
+https://ldap.com/ldapv3-wire-protocol-reference-abandon/
diff --git a/tests/ldap-abandon/ldap.pcap b/tests/ldap-abandon/ldap.pcap
diff --git a/tests/ldap-abandon/ldap.syn b/tests/ldap-abandon/ldap.syn
@@ -0,0 +1,2 @@
+flow default tcp 1.1.1.1:5555 > 2.2.2.2:389 (tcp.initialize; mss:9000;);
+default > (content:"\x30\x06\x02\x01\x06\x50\x01\x05";);
diff --git a/tests/ldap-abandon/test.yaml b/tests/ldap-abandon/test.yaml
@@ -0,0 +1,15 @@
+requires:
+  min-version: 8
+
+args:
+  - -k none
+
+pcap: ldap.pcap
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: ldap
+        ldap.request.message_id: 6
+        ldap.request.operation: abandon_request
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		flow default tcp 1.1.1.1:5555 > 2.2.2.2:389 (tcp.initialize; mss:9000;);
		default > (content:"\x30\x06\x02\x01\x06\x50\x01\x05";);