@@ -591,6 +591,23 @@ func Tcpv6ConnectionClose(t *testing.T, et *Runner) {
591
591
require .Equal (t , ev .Comm , "tcpv6_connect" )
592
592
}
593
593
594
+ func DNSMonitor (t * testing.T , et * Runner ) {
595
+ type dnsOutput struct {
596
+ Data []uint8 `json:"data"`
597
+ NetConnAcceptEvent
598
+ }
599
+ runTestBin (t , "udp_send" )
600
+
601
+ lineData := dnsOutput {}
602
+ et .UnmarshalNextEvent (& lineData , "DNS_EVENT" )
603
+
604
+ require .Equal (t , lineData .Net .Transport , "UDP" )
605
+ require .Equal (t , lineData .Net .Family , "AF_INET" )
606
+
607
+ require .NotZero (t , lineData .Data [0 ])
608
+ require .NotZero (t , lineData .Data [1 ])
609
+ }
610
+
594
611
func TestEbpf (t * testing.T ) {
595
612
hasOverlayFS := IsOverlayFsSupported (t )
596
613
@@ -616,6 +633,7 @@ func TestEbpf(t *testing.T) {
616
633
{"Tcpv6ConnectionAttempt" , Tcpv6ConnectionAttempt , []string {"--net-conn-attempt" }, false },
617
634
{"Tcpv6ConnectionAccept" , Tcpv6ConnectionAccept , []string {"--net-conn-accept" }, false },
618
635
{"Tcpv6ConnectionClose" , Tcpv6ConnectionClose , []string {"--net-conn-close" }, false },
636
+ {"DNSMonitor" , DNSMonitor , []string {"--net-conn-dns-pkt" }, false },
619
637
620
638
{"FileCreateContainer" , FileCreateContainer , []string {"--file-create" }, true },
621
639
{"FileRenameContainer" , FileRenameContainer , []string {"--file-rename" }, true },
0 commit comments